CVE-2025-9648: Denial of Service in CivetWeb
A vulnerability in the CivetWeb library's function mghandleformrequest allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests.
This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9648?
CVE-2025-9648 has a high severity as it allows remote attackers to cause denial of service conditions.
How do I fix CVE-2025-9648?
To fix CVE-2025-9648, you should update to the latest version of the CivetWeb library that addresses this vulnerability.
What causes the denial of service in CVE-2025-9648?
The denial of service in CVE-2025-9648 is caused by a specially crafted HTTP POST request containing a null byte, leading the server into an infinite loop.
Which versions of CivetWeb are affected by CVE-2025-9648?
CVE-2025-9648 affects various versions of the CivetWeb library, so it's essential to check the specific version you are using.
Can CVE-2025-9648 be exploited remotely?
Yes, CVE-2025-9648 can be exploited remotely, allowing attackers to send malicious requests over the network.