Skip to content
OpenAdvisories

Package · Debian

civetweb

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • High 8.1
    CVE-2026-124040 Public exploit

    CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State

    CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseud…

    CivetWeb CivetWeb civetweb civetweb Debian Ubuntu
  • Medium 6.5
    CVE-2026-29035

    CivetWeb Heap/Stack Buffer Overflow via WebSocket permessage-deflate Decompression

    CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the read_websocket() function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USE_ZLIB and MG_EXPERIMENTAL_IN…

    CivetWeb CivetWeb civetweb Debian
  • High 8.7
    CVE-2025-9648

    Denial of Service in CivetWeb

    A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infi…

    CivetWeb CivetWeb civetweb civetweb Debian Ubuntu
  • High 7.5
    CVE-2025-55763 Public exploit

    Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote cod…

    civetweb civetweb Debian Ubuntu
  • Unscored —
    CVE-2020-27304

    The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the …

    civetweb_project civetweb civetweb civetweb Debian Ubuntu