CVE-2025-9648
Denial of Service in CivetWeb
A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests.
This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Denial of Service in CivetWeb
A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests.
This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.
- Record
CVE-2025-9648- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-158
- Updated
- 2026-11-02
EUVDEUVD-2025-31569
A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests.
This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.
- Record
EUVD-2025-31569- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2gxg-pvm2-2p6x
A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers...
A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests.
This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.
- Record
GHSA-2gxg-pvm2-2p6x- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-158
- Updated
- 2026-11-02
NVD
A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests.
This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.
- Record
CVE-2025-9648- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-158
- Updated
- 2026-11-02
OSV
Denial of Service in CivetWeb
A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests.
This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.
- Record
CVE-2025-9648- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-158
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-9648
A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests. This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.
- Record
DEBIAN-CVE-2025-9648- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2025-9648
A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests. This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.
- Record
UBUNTU-CVE-2025-9648- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVAZL-68073 No score
CVE-2025-9648 affecting package ceph for versions less than 18.2.2-11
A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests.
This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.
- Record
AZL-68073- Updated
- 2026-11-05
OSVAZL-68085 No score
CVE-2025-9648 affecting package ceph for versions less than 16.2.10-10
A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests.
This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.
- Record
AZL-68085- Updated
- 2026-11-02
OSVUSN-8749-1 No score
civetweb vulnerabilities
It was discovered that CivetWeb did not correctly handle parsing certain URIs. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-55763)
It was discovered that CivetWeb did not correctly handle parsing certain HTTP requests. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2025-9648)
- Record
USN-8749-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cephAzure Linux:3 |
before 18.2.2-11 | 18.2.2-11 |
cephAzure Linux:2 |
before 16.2.10-10 | 16.2.10-10 |
civetwebDebian:12 |
All versions, plus listed versions 1.15+dfsg-41.16+dfsg-11.16+dfsg-21.16+dfsg-31.16+dfsg-41.16+dfsg-51.16+dfsg-6 |
None known |
civetwebDebian:13 |
before 1.16+dfsg-2+deb13u1, plus listed versions 1.16+dfsg-2 |
1.16+dfsg-2+deb13u1 |
civetwebDebian:14 |
before 1.16+dfsg-4, plus listed versions 1.16+dfsg-21.16+dfsg-3 |
1.16+dfsg-4 |
civetwebUbuntu:Pro:22.04:LTS |
before 1.15+dfsg-3ubuntu0.1~esm1, plus listed versions 1.13+dfsg-51.15+dfsg-11.15+dfsg-3 |
1.15+dfsg-3ubuntu0.1~esm1 |
civetwebUbuntu:24.04:LTS |
before 1.16+dfsg-1ubuntu0.1, plus listed versions 1.16+dfsg-11.16+dfsg-1build1 |
1.16+dfsg-1ubuntu0.1 |
civetwebUbuntu:25.10 |
All versions, plus listed versions 1.16+dfsg-2 |
None known |
civetwebUbuntu:26.10 |
All versions, plus listed versions 1.16+dfsg-31.16+dfsg-4 |
None known |
civetwebUbuntu:26.04:LTS |
before 1.16+dfsg-3ubuntu0.1, plus listed versions 1.16+dfsg-21.16+dfsg-3 |
1.16+dfsg-3ubuntu0.1 |
civetwebUbuntu:Pro:22.04:LTS From an advisory covering 2 CVEs |
before 1.15+dfsg-3ubuntu0.1~esm1, plus listed versions 1.13+dfsg-51.15+dfsg-11.15+dfsg-3 |
1.15+dfsg-3ubuntu0.1~esm1 |
civetwebUbuntu:24.04:LTS From an advisory covering 2 CVEs |
before 1.16+dfsg-1ubuntu0.1, plus listed versions 1.16+dfsg-11.16+dfsg-1build1 |
1.16+dfsg-1ubuntu0.1 |
civetwebUbuntu:26.04:LTS From an advisory covering 2 CVEs |
before 1.16+dfsg-3ubuntu0.1, plus listed versions 1.16+dfsg-21.16+dfsg-3 |
1.16+dfsg-3ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-9648 is a high vulnerability (CVSS 8.7) in Civetweb, published September 29, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.76%, the 55th percentile. Fixed in ceph 18.2.2-11.