PT-2025-39825 · Civetweb+1 · Civetweb+1

Artur Łącki · Published 2025-09-29 · Updated 2025-10-02 · CVE-2025-9648

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions CivetWeb versions prior to 1.08

Description A flaw in the mg handle form request function within the CivetWeb library can be exploited to cause a denial of service (DoS) condition. Sending a specially crafted HTTP POST request with a null byte in the payload causes the server to enter an infinite loop during form data parsing, leading to CPU exhaustion and service unresponsiveness. Multiple malicious requests can completely exhaust CPU resources.

Recommendations Update to CivetWeb version 1.08 or later.

Fix

DoS

Weakness Enumeration

CWE-158

Related Identifiers

AZL-68073

AZL-68085

CVE-2025-9648

Affected Products

Civetweb

Debian

References · 19

• https://github.com/civetweb/civetweb/commit/782e18903515f43bafbf2e668994e82bdfa51133 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-9648 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-68073 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-9648 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-9648 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-9648 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9648 · Security Note
• https://osv.dev/vulnerability/AZL-68085 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-9648 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-9648 · Vendor Advisory
• https://github.com/civetweb/civetweb · Note
• https://github.com/civetweb/civetweb/issues/1348 · Note
• https://cert.pl/en/posts/2025/09/CVE-2025-9648 · Note
• https://t.me/CVEtracker/33626 · Telegram Post
• https://twitter.com/VolerionSec/status/1972637192695480797 · Twitter Post