Artur Łącki

**Name of the Vulnerable Software and Affected Versions** CivetWeb versions prior to 1.08 **Description** A flaw in the `mg handle form request` function within the CivetWeb library can be exploited to cause a denial of service (DoS) condition. Sending a specially crafted HTTP POST request with a null byte in the payload causes the server to enter an infinite loop during form data parsing, leading to CPU exhaustion and service unresponsiveness. Multiple malicious requests can completely exhaust CPU resources. **Recommendations** Update to CivetWeb version 1.08 or later.

**Name of the Vulnerable Software and Affected Versions** lua-http versions before commit ddab283 **Description** The issue is related to an Improper Handling of Exceptional Conditions vulnerability in the Daurnimator lua-http library, which allows Excessive Allocation and a denial of service (DoS) attack to be executed by sending a properly crafted request to the server. Such a request causes the program to enter an infinite loop. **Recommendations** For lua-http versions before commit ddab283, update to a version after commit ddab283 to resolve the issue. As a temporary workaround, consider restricting access to the lua-http library to minimize the risk of exploitation. Avoid using the library until the issue is resolved.