TI-2025-19980 Aliases CVE-2025-27110

Libmodsecurity3 has possible bypass of encoded HTML entities

HIGH 74CWE-172Published 2025-02-25 · Updated 2025-02-26

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurity3 can't decode encoded HTML entities if they contains leading zeroes. Version 3.0.14 contains a fix. No known workarounds are available.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00485 42nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
owasp-modsecurity	ModSecurity	= 3.0.13	—	No fix listed	CNA

ModSecurity Vendorowasp-modsecurity Affected = 3.0.13 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:trustwave:modsecurity:3.0.13:::::::*	3.0.13	Vulnerable	Trustwave

cpe:2.3:a:trustwave:modsecurity:3.0.13:*:*:*:*:*:*:* Versions 3.0.13 Vulnerable ·Trustwave

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 4 products

Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat JBoss Core Services

Timeline

2026-10-02 Threatist record created from CVE-2025-27110

References

Exploit 1

https://github.com/owasp-modsecurity/ModSecurity/issues/3340

Advisory 1

https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-42w7-rmv5-4x2j

TI-2026-37865 ModSecurity: Multipart form-data parser silently strips embedded line breaks from… CVSS 3.1HIGH 8.6
TI-2025-40548 FACTION Unauthenticated Custom Extension Upload leads to RCE CVSS 3.1CRITICAL 9.8
TI-2022-07517 Path Traversal in ESAPI CVSS 3.1CRITICAL 9.8
TI-2026-30581 ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators CVSS 4.0HIGH 8.2
TI-2026-23748 libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings CVSS 4.0HIGH 8.2
TI-2026-29093 OWASP BLT has RCE in Github Actions via untrusted Django model execution in workflow CVSS 3.1HIGH 8.8

See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences