CVE-2025-9648

Name of the Vulnerable Software and Affected Versions CivetWeb versions prior to 1.08

Description A flaw in the mg handle form request function within the CivetWeb library can be exploited to cause a denial of service (DoS) condition. Sending a specially crafted HTTP POST request with a null byte in the payload causes the server to enter an infinite loop during form data parsing, leading to CPU exhaustion and service unresponsiveness. Multiple malicious requests can completely exhaust CPU resources.

Recommendations Update to CivetWeb version 1.08 or later.