UpHeron
All vulnerabilities

Servers and applications

CVE-2025-27110

Encoded HTML entities possible bypass

Severity
High 7.9
Published
25 Feb 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Also known as
GHSA-42w7-rmv5-4x2j
Sources
NVD, Project advisories (GitHub)

Description

Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurity3 can't decode encoded HTML entities if they contains leading zeroes. Version 3.0.14 contains a fix.…

Affected software

SoftwareAffected versions
ModSecurityServers and applications · cpe:a:trustwave:modsecurity
  • Version 3.0.13
ModSecurityServers and applications · github:owasp-modsecurity/modsecurity
  • Version 3.0.13

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-27110
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-27110
  • GitHub Advisory Database https://github.com/advisories/GHSA-42w7-rmv5-4x2j
  • github.com https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-42w7-rmv5-4x2j