Source: civetweb Version: 1.16+dfsg-3 Severity: important Tags: security upstream Forwarded: https://github.com/civetweb/civetweb/issues/1348 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]> Control: found -1 1.16+dfsg-2
Hi, The following vulnerability was published for civetweb. CVE-2025-9648[0]: | A vulnerability in the CivetWeb library's function | mg_handle_form_request allows remote attackers to trigger a denial | of service (DoS) condition. By sending a specially crafted HTTP POST | request containing a null byte in the payload, the server enters an | infinite loop during form data parsing. Multiple malicious requests | will result in complete CPU exhaustion and render the service | unresponsive to further requests. This issue was fixed in commit | 782e189. This issue affects only the library, standalone executable | pre-built by vendor is not affected. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2025-9648 https://www.cve.org/CVERecord?id=CVE-2025-9648 [1] https://github.com/civetweb/civetweb/issues/1348 [2] https://github.com/civetweb/civetweb/commit/782e18903515f43bafbf2e668994e82bdfa51133 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
