{"id":"CVE-2025-55763","aliases":["DEBIAN-CVE-2025-55763","EUVD-2025-26228","GHSA-2757-2hpv-v482","UBUNTU-CVE-2025-55763","USN-8749-1","openSUSE-SU-2026:10818-1"],"status":"published","title":"Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker...","description":"Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to denial of service or arbitrary code execution.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.01198,"percentile":0.68522,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-121"],"published":"2025-08-29T00:00:00Z","modified":"2026-11-08T10:00:10Z","exploits":[{"source":"pocgithub","id":"krispybyte/CVE-2025-55763","title":"krispybyte/CVE-2025-55763","date":"2025-08-29","url":"https://github.com/krispybyte/CVE-2025-55763"}],"fixes":[{"ecosystem":"Debian:13","package":"civetweb","fixed_in":["1.16+dfsg-2+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"civetweb","fixed_in":["1.16+dfsg-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"civetweb","fixed_in":["1.15+dfsg-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"civetweb","fixed_in":["1.16+dfsg-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"civetweb","fixed_in":["1.16+dfsg-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"civetweb","fixed_in":["1.16+dfsg-3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"civetweb","fixed_in":["1.6+git1776611085.588860e3-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"civetweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15+dfsg-4","1.16+dfsg-1","1.16+dfsg-2","1.16+dfsg-3","1.16+dfsg-4","1.16+dfsg-5","1.16+dfsg-6"]},{"source":"osv","ecosystem":"Debian:13","package":"civetweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16+dfsg-2+deb13u1"}]}],"versions":["1.16+dfsg-2"]},{"source":"osv","ecosystem":"Debian:14","package":"civetweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16+dfsg-3"}]}],"versions":["1.16+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"civetweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15+dfsg-3ubuntu0.1~esm1"}]}],"versions":["1.13+dfsg-5","1.15+dfsg-1","1.15+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"civetweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16+dfsg-1ubuntu0.1"}]}],"versions":["1.16+dfsg-1","1.16+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"civetweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"civetweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16+dfsg-3"}]}]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"civetweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16+dfsg-3"}]}],"versions":["1.16+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"civetweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15+dfsg-3ubuntu0.1~esm1"}]}],"versions":["1.13+dfsg-5","1.15+dfsg-1","1.15+dfsg-3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"civetweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16+dfsg-1ubuntu0.1"}]}],"versions":["1.16+dfsg-1","1.16+dfsg-1build1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"civetweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16+dfsg-3ubuntu0.1"}]}],"versions":["1.16+dfsg-2","1.16+dfsg-3"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"civetweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6+git1776611085.588860e3-1.1"}]}]}],"products":[{"vendor":"civetweb_project","product":"civetweb"}],"references":[{"url":"https://github.com/civetweb/civetweb","tags":["Product","package","report"]},{"url":"https://github.com/krispybyte/CVE-2025-55763","tags":["Exploit","Third Party Advisory","package","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55763","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2757-2hpv-v482"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55763.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-55763","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-55763","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55763","tags":["report"]},{"url":"https://github.com/civetweb/civetweb/pull/1347","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8749-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-9648","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55763","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-55763","description":"Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to denial of service or arbitrary code execution.","status":"published","published":"2025-08-29T00:00:00Z","modified":"2025-08-29T17:05:30.204Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:32:52.839698Z"}],"euvd":[{"id":"EUVD-2025-26228","description":"Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to denial of service or arbitrary code execution.","status":"published","published":"2025-08-29T00:00:00Z","modified":"2025-08-29T17:05:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:31:49.600955Z"}],"ghsa":[{"id":"GHSA-2757-2hpv-v482","title":"Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker...","description":"Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to denial of service or arbitrary code execution.","status":"published","published":"2025-08-29T18:30:52Z","modified":"2025-08-29T18:31:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:03:27.857466Z"}],"nvd":[{"id":"CVE-2025-55763","description":"Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to denial of service or arbitrary code execution.","status":"published","published":"2025-08-29T17:15:35.79Z","modified":"2026-11-07T18:10:00.2Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-07T20:06:28.095135Z"}],"osv":[{"id":"CVE-2025-55763","description":"Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to denial of service or arbitrary code execution.","status":"published","published":"2025-08-29T00:00:00Z","modified":"2026-11-09T02:30:32.037255976Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-09T03:16:44.651171Z"},{"id":"DEBIAN-CVE-2025-55763","description":"Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to denial of service or arbitrary code execution.","status":"published","published":"2025-08-29T17:15:35.79Z","modified":"2026-11-08T10:00:10.528702323Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-08T10:03:28.621517Z"},{"id":"UBUNTU-CVE-2025-55763","description":"Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to denial of service or arbitrary code execution.","status":"published","published":"2025-08-29T17:15:00Z","modified":"2026-10-17T12:57:08.46806396Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"openSUSE-SU-2026:10818-1","title":"civetweb-1.6+git1776611085.588860e3-1.1 on GA media","description":"These are all security issues fixed in the civetweb-1.6+git1776611085.588860e3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-20T00:00:00Z","modified":"2026-05-21T08:15:09.002436066Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"USN-8749-1","title":"civetweb vulnerabilities","description":"It was discovered that CivetWeb did not correctly handle parsing certain\nURIs. A remote attacker could possibly use this issue to cause a denial\nof service or execute arbitrary code. This issue only affected\nUbuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-55763)\n\nIt was discovered that CivetWeb did not correctly handle parsing certain\nHTTP requests. A remote attacker could possibly use this issue to cause\na denial of service. (CVE-2025-9648)","status":"published","published":"2026-09-14T01:27:29Z","modified":"2026-09-14T11:27:23.8228973Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}