Libmodsecurity3 has possible bypass of encoded HTML entities
Summary
Libmodsecurity3 has possible bypass of encoded HTML entities
Original description
The description as published by the source.
Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurity3 can't decode encoded HTML entities if they contains leading zeroes. Version 3.0.14 contains a fix. No known workarounds are available.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-27110 modsecurity Fixed in: 3.0.14-1
- Ubuntu UBUNTU-CVE-2025-27110 modsecurity
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- report github.com