Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-9648

29
FAUCET Score

CVE-2025-9648 describes a denial-of-service vulnerability in the CivetWeb library's mg_handle_form_request function. Remote attackers can trigger an infinite loop and CPU exhaustion by sending a specially crafted HTTP POST request containing a null byte, rendering the service unresponsive. This vulnerability has a CVSS score of 8.7 (HIGH) due to its network attack vector, low attack complexity, and high impact on availability. While no active exploitation or public exploit code is currently reported, and community discussion is minimal, the FAUCET Risk Score of 84/100 indicates significant potential risk. The issue affects only the CivetWeb library and not vendor-pre-built standalone executables.

Impacted Technologies

VendorProductVersion(s)CPE
CivetWebCivetWeb
>= 1.10, <= 1.16CNA affecteddefault unaffected

CVSS Data

CVSS version used by this source: 4.0

8.7HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
VS Confidentiality
NONE
VS Integrity
NONE
VS Availability
HIGH
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.71%
Probability of exploitation in next 30 days
EPSS Percentile
49.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.0071 is in the 26th percentile among its peer group of 51,485 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (7)

microsoftpatch availablevia msrc
Product: 19531-17084Fixed in: 18.2.2-11
microsoftpatch availablevia msrc
Product: 19540-17086Fixed in: 16.2.10-10
microsoftpatch availablevia msrc
Product: azl3 ceph 18.2.2-10 on Azure Linux 3.0Fixed in: 18.2.2-11
microsoftpatch availablevia msrc
Product: cbl2 ceph 16.2.10-9 on CBL Mariner 2.0Fixed in: 16.2.10-10
redhatpatch availablevia redhat_api
Product: Red Hat Advanced Cluster Security 4.8Fixed in: advanced-cluster-security/rhacs-collector-rhel8:sha256:4e13827b69f9e8be0771e36046c60ec35522b8ab6b93215687fbda51ba928afc
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Advanced Cluster Security 4.9Fixed in: advanced-cluster-security/rhacs-collector-rhel8:sha256:bb30abe978ff9a89ef5f954d26a2536a40327f2d40bc58a75287eeb9a17e9cca
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Advanced Cluster Security 4.7Fixed in: advanced-cluster-security/rhacs-collector-rhel8:sha256:271dd3bfa99f1043d3ee885764fda7d3ba89c232025c1d3ad7fe45324f47473d
View patch

Vendor Advisories (2)

redhatCVE-2025-9648Moderate

civetweb: Denial of Service in CivetWeb

Sep 29, 2025
microsoft2025-Sep/CVE-2025-9648Important

Denial of Service in CivetWeb

Sep 9, 2025

References

cert.pl / en/posts/2025/09/CVE-2025-9648
github.com / civetweb/civetweb
github.com / civetweb/civetweb/commit/782e18903515f43bafbf2e668994e82bdfa51133
github.com / civetweb/civetweb/issues/1348