CVE-2025-27110

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-27110
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-27110.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-27110
Aliases
Downstream
Related
Published
2025-02-25T20:00:44.211Z
Modified
2026-03-20T12:41:42.997787Z
Severity
  • 7.9 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
Libmodsecurity3 has possible bypass of encoded HTML entities
Details

Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurity3 can't decode encoded HTML entities if they contains leading zeroes. Version 3.0.14 contains a fix. No known workarounds are available.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27110.json",
    "cwe_ids": [
        "CWE-172"
    ]
}
References

Affected packages

Git / github.com/owasp-modsecurity/modsecurity

Affected ranges

Type
GIT
Repo
https://github.com/owasp-modsecurity/modsecurity
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
580fe192df1694934f93e3e008058996ea479e35
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "= 3.0.13"
        }
    ]
}

Affected versions

v2.*
v2.7.2
v2.7.3
v2.7.4
v2.7.5
v2.7.6
v2.7.7
v2.9.0
v2.9.0-rc1
v2.9.0-rc2
v3.*
v3.0.0
v3.0.0-rc1
v3.0.1
v3.0.10
v3.0.11
v3.0.12
v3.0.13
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.0.7
v3.0.8
v3.0.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-27110.json"