Read the docs
TI-2025-08840 Aliases CVE-2025-9648GHSA-2gxg-pvm2-2p6x

Denial of Service in CivetWeb

Priority MEDIUM 45CWE-158Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests. This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00762 55th percentileScored 2026-11-08
Fix Fixed Red Hat: 3 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CivetWebCivetWeb1.10 – 1.16—Patch availableCNA
  • CivetWeb VendorCivetWeb Affected 1.10 – 1.16 Fixed in — Patch available CNA

Remediation

Red Hat 3 advisories

  • RHSA-2025:23248 Released 2025-12-16 · Red Hat rating Important
    RHSA 4.7.9 security and bug fix update
    • Red Hat Advanced Cluster Security 4.7 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +8
  • RHSA-2025:22179 Released 2025-11-26 · Red Hat rating Moderate
    RHSA 4.8.6 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8
  • RHSA-2025:21929 Released 2025-11-24 · Red Hat rating Moderate
    RHSA 4.9.1 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Security 4.7Fixed RHSA-2025:23248
Red Hat Advanced Cluster Security 4.8Fixed RHSA-2025:22179
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2025:21929
Not affected: 4 products
  • Red Hat Advanced Cluster Security 4
  • Red Hat Advanced Cluster Security 4.7
  • Red Hat Advanced Cluster Security 4.8
  • Red Hat Advanced Cluster Security 4.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-9648
  2. 2026-10-03 Alias added: GHSA-2gxg-pvm2-2p6x

References

Patch 1

Advisory 1

Other 2

  • TI-2026-86093 Use-after-free in CivetWeb HTTP/2 pseudo-header handling CVSS 4.0CRITICAL 9.2
  • TI-2026-23182 CivetWeb Heap/Stack Buffer Overflow via WebSocket permessage-deflate Decompression CVSS 4.0HIGH 8.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences