Read the docs

CivetWeb

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

CivetWeb records in CISA KEV

No CivetWeb vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2025-08840 CVE-2025-9648 · GHSA-2gxg-pvm2-2p6x

Denial of Service in CivetWeb

Priority MEDIUM 45

A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00756 Published 2025-09-29 Fixed CWE-158
TI-2026-86093 CVE-2026-124040 · GHSA-wj2x-x5pc-4h8r

Use-after-free in CivetWeb HTTP/2 pseudo-header handling

Priority MEDIUM 40

CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00514 Published 2026-11-06 No fix listed CWE-416
TI-2026-23182 CVE-2026-29035 · GHSA-xvrx-cw3m-h23c

CivetWeb Heap/Stack Buffer Overflow via WebSocket permessage-deflate Decompression

Priority LOW 37

CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the read_websocket() function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames wh…

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00612 Published 2026-08-11 No fix listed CWE-787
Open these records in search →