CVE-2025-9648
A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests. This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.76%
- CWE
- CWE-158
- Published
- 2025-09-29
- Last modified
- 2026-03-12
Affected products
- CivetWeb CivetWeb
- CivetWeb CivetWeb
- CivetWeb CivetWeb
Weakness type
Related vulnerabilities
- CVE-2026-76354 — Path Traversal through Search Head Clustering in Splunk Enterprise
- CVE-2026-70603 — Electron: shell.openPath path validation bypass via embedded null byte
- CVE-2026-47778 — Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)
- CVE-2026-43895 — jq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifacts
- CVE-2026-41256 — jq: Embedded NUL truncates top-level jq programs loaded with -f
- CVE-2026-43861 — mutt before 2.3.2 does not check for '\0' in url_pct_decode.
- CVE-2026-43859 — mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.
- CVE-2026-33191 — free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error