VDB
CVE-2025-9648
CVE-2025-9648
PUBLISHED
CVSS 8.699999809265137 HIGH
A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests. This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.
EPSS 0.98% · 77.1th percentile
Risk Scores
CVSS 4.0
8.699999809265137
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS Score
0.98%
77.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| CivetWeb | CivetWeb | 1.08, 1.10, 0 |
Exploit Intelligence
Timeline
- Sep 29, 2025 EPSS Score
- Sep 29, 2025 CVE Published
- Sep 29, 2025 CVE Updated
- Oct 6, 2025 EPSS Score
- Oct 12, 2025 EPSS Score
- Oct 19, 2025 EPSS Score
- Oct 26, 2025 EPSS Score
- Nov 1, 2025 EPSS Score
- Nov 8, 2025 EPSS Score
- Nov 15, 2025 EPSS Score
- Nov 21, 2025 EPSS Score
- Nov 28, 2025 EPSS Score
References
- https://cert.pl/en/posts/2025/09/CVE-2025-9648 third-party-advisory
- https://github.com/civetweb/civetweb url
- https://github.com/civetweb/civetweb/issues/1348 issue
- https://github.com/civetweb/civetweb/commit/782e18903515f43bafbf2e668994e82bdfa51133 patch
- https://nvd.nist.gov/vuln/detail/CVE-2025-9648 advisory