CVE-2025-9648

Denial of Service in CivetWeb

High8.7EPSS 0.76%

Published: 29 Sept 2025
Updated: 29 Sept 2025
Reserved: 29 Aug 2025
Assigned by: CERT-PL

Description

A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests. This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.

Scores

CVSS scores of CVE-2025-9648, by who scored it
Scored by	CVSS	Score	Vector
CERT-PLCNA (assigner)	4.0	High8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
NVDNVD · Deferred	4.0	High8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.76% · top 45% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.

Weakness

CWE-158 Improper Neutralization of Null Byte or NUL Character (opens in a new tab)All about CWE-158 and its CVEs

Affected products

CivetWeb · CivetWeb
- unaffected < 1.08
- unknown 1.08 – < 1.10
- affected 1.10 – ≤ 1.16

References (4)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-9648](https://trackcve.app/badge/CVE-2025-9648.svg)](https://trackcve.app/cve/CVE-2025-9648)

Record last updated 29 Sept 2025, 12:53 UTC.