CVE-2025-9648
Denial of Service in CivetWeb
概要
Denial of Service in CivetWeb
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests.
This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2025-9648 civetweb
- Ubuntu UBUNTU-CVE-2025-9648 civetweb
参照URL
- advisory cert.pl
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- report github.com