CVE-2025-9648 — Vulnetix

Try Vulnetix Request Demo

CVE-2025-9648 PUBLISHED CVSS 8.699999809265137 HIGH

A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests. This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.

EPSS 1.90% · 83.1th percentile

Risk Scores

CVSS v4.0

8.699999809265137

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS Score

1.90%

83.1th percentile

Affected Products

Vendor	Product	Versions
CivetWeb	CivetWeb	0, 1.08, 1.10

Timeline

Sep 29, 2025 EPSS Score
Sep 29, 2025 CVE Published
Sep 29, 2025 CVE Updated
Oct 5, 2025 EPSS Score
Oct 11, 2025 EPSS Score
Oct 17, 2025 EPSS Score
Oct 23, 2025 EPSS Score
Nov 5, 2025 EPSS Score
Nov 11, 2025 EPSS Score
Nov 17, 2025 EPSS Score
Nov 18, 2025 EPSS Score
Nov 21, 2025 EPSS Score

References

https://cert.pl/en/posts/2025/09/CVE-2025-9648 third-party-advisory
https://github.com/civetweb/civetweb url
https://github.com/civetweb/civetweb/issues/1348 issue
https://github.com/civetweb/civetweb/commit/782e18903515f43bafbf2e668994e82bdfa51133 patch
https://nvd.nist.gov/vuln/detail/CVE-2025-9648 advisory

Open in Interactive Console →