Skip to content
OpenAdvisories
High USN-8749-1 2 CVEs

civetweb vulnerabilities

Published Sep 14, 2026 · Updated Sep 14, 2026

Ecosystem: Ubuntu

Summary

It was discovered that CivetWeb did not correctly handle parsing certain
URIs. A remote attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-55763)

It was discovered that CivetWeb did not correctly handle parsing certain
HTTP requests. A remote attacker could possibly use this issue to cause
a denial of service. (CVE-2025-9648)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 24.04 LTS 24.04:LTS civetweb 1.16+dfsg-1ubuntu0.1
Ubuntu · 26.04 LTS 26.04:LTS civetweb 1.16+dfsg-3ubuntu0.1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS civetweb 1.15+dfsg-3ubuntu0.1~esm1

Vulnerabilities 2

  • High 8.7
    CVE-2025-9648

    Denial of Service in CivetWeb

    A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infi…

    CivetWeb CivetWeb ceph civetweb Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2025-55763 Public exploit

    Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote cod…

    civetweb civetweb Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2025-9648
  • report
    https://ubuntu.com/security/CVE-2025-55763