CVE-2025-27110 Libmodsecurity3 has possible bypass of encoded HTML entities
Attackers can bypass ModSecurity protections by using encoded HTML entities with leading zeroes, requiring an upgrade to the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-27110?
CVE-2025-27110 is a high-severity vulnerability in owasp-modsecurity ModSecurity, published on 25 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurity3 can't decode encoded HTML entities if they contains leading zeroes. Version 3.0.14 contains a fix. No known workarounds are available.
Weakness: CWE-172
Which versions are affected by CVE-2025-27110?
2 open source packages ship an affected version, including modsecurity and modsecurity2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
modsecurity Bitnami | From 3.0.13 | 3.0.14 |
modsecurity2 Bitnami | From 3.0.13 | None |
Linux distribution packages (1)
modsecurity openSUSE:Tumbleweed | All versions | 3.0.14-1.1 |
Products include Trustwave Modsecurity.
How do I fix CVE-2025-27110?
Upgrade modsecurity to 3.0.14 or later.
Is CVE-2025-27110 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-27110 exists.
Other vulnerabilities in owasp-modsecurity ModSecurity
Sources
Also known as BIT-modsecurity-2025-27110, BIT-modsecurity2-2025-27110, DEBIAN-CVE-2025-27110, GHSA-42w7-rmv5-4x2j, UBUNTU-CVE-2025-27110, openSUSE-SU-2025:14946-1.