CVE Feed

    Dashboard / CVE / CVE-2025-27110

    CVE-2025-27110

    Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurity3 can't decode encoded HTML entities if they contains leading zeroes. Version 3.0.14 contains a fix. No known workarounds are available.

    Published:Feb 25, 2025
    Last Modified:Feb 26, 2025
    EPS:Feb 25, 2025
    EPSS Score:0.0006
    CVSS Score:8.6

    Affected Products

    No affected product recorded yet

    Exploits

    https://github.com/owasp-modsecurity/ModSecurity/issues/3340

    Common Weakness Enumeration

    CWE-172 Encoding Error

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High