ModSecurity is an open‑source web application firewall that applies a series of rules to HTTP requests. The HTML entity decoder, t:htmlEntityDecode, only recognizes a small subset of named entities in earlier releases. Consequently, attackers can encode separators and operators with unhandled or aliased entity names, causing the decoder to transform the payload into bytes different from what a browser or backend would receive. This discrepancy allows malicious requests to bypass any rule that depends on the standard HTML entity decoding step, potentially exposing the protected application to injection or cross‑site scripting attacks that the firewall intended to block.

The vulnerability affects all ModSecurity deployments that use the HTML entity decoding transformation in Apache, IIS, or Nginx installations. Versions prior to 2.9.15 and 3.0.17 of ModSecurity include the unpatched decoder and are therefore impacted. Any environment that configures rules relying on t:htmlEntityDecode is at risk.

The CVSS score of 6.3 indicates a moderate severity, and the EPSS score is not available; the issue is not listed in the CISA KEV catalog. Attackers can remotely exploit the flaw by sending HTTP requests that contain encoded entity names which the decoder does not recognize or matches on a prefix, thereby transforming the request payload in a way that evades the WAF’s rule set. The exploit requires that the target is using the default or a custom transformation rule that includes t:htmlEntityDecode, making it a success‑dependent vulnerability common to any ModSecurity deployment prior to the patched releases.