Skip to content
OpenAdvisories

Package · Ubuntu

civetweb

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • High 8.1
    CVE-2026-124040 Public exploit

    CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State

    CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseud…

    CivetWeb CivetWeb civetweb civetweb Debian Ubuntu
  • High 8.5
    CVE-2026-5789

    Search path without quotes in CivetWeb

    Vulnerability related to an unquoted search path in CivetWeb v1.16. This vulnerability allows a local attacker to execute arbitrary code with elevated privileges by placing a malicious executable in a directory that is scanned before the intended application …

    CivetWeb CivetWeb civetweb Ubuntu
  • High 8.7
    CVE-2025-9648

    Denial of Service in CivetWeb

    A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infi…

    CivetWeb CivetWeb civetweb civetweb Debian Ubuntu
  • High 7.5
    CVE-2025-55763 Public exploit

    Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote cod…

    civetweb civetweb Debian Ubuntu
  • Unscored —
    CVE-2020-27304

    The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the …

    civetweb_project civetweb civetweb civetweb Debian Ubuntu