CVE-2025-27110

Name	CVE-2025-27110
Description	Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurity3 can't decode encoded HTML entities if they contains leading zeroes. Version 3.0.14 contains a fix. No known workarounds are available.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1098910

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
modsecurity (PTS)	bullseye	3.0.4-2	fixed
	bookworm	3.0.9-1+deb12u1	fixed
	forky, sid, trixie	3.0.14-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
modsecurity	source	bullseye	(not affected)
modsecurity	source	bookworm	(not affected)
modsecurity	source	(unstable)	3.0.14-1	1098910

Notes

[bookworm] - modsecurity <not-affected> (Vulnerable code not present)
[bullseye] - modsecurity <not-affected> (Vulnerable code not present)
https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-42w7-rmv5-4x2j
https://github.com/owasp-modsecurity/ModSecurity/issues/3340
Fixed by: https://github.com/owasp-modsecurity/ModSecurity/commit/c82e831b6640836eeef6f5418c8482063814dc34 (v3.0.14)