High severity · published Feb 25, 2025
CVE-2025-27110
Libmodsecurity is one component of the ModSecurity v3 project
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurity3 can't decode encoded HTML entities if they contains leading zeroes. Version 3.0.14 contains a fix. No known workarounds are available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Modsecurity · Trustwave
3.0.13 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27110
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27110
Exploit
https://github.com/owasp-modsecurity/ModSecurity/issues/3340
Vendor Advisory
https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-42w7-rmv5-4x2j
More from Modsecurity
7.5
CVE-2025-47947
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx
7.5
CVE-2024-46292
A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name parameter
7.5
CVE-2023-24021
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall…
7.5
CVE-2022-48279
In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall
7.5
CVE-2021-42717
ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects