CVE-2025-9648
BaseFortify
Publication date: 2025-09-29
Last updated on: 2025-09-29
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| civetweb | civetweb | 1.16 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-158 | The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-9648 is a denial-of-service (DoS) vulnerability in the CivetWeb library's function mg_handle_form_request. When a remote attacker sends a specially crafted HTTP POST request containing a null byte in the form payload, the server enters an infinite loop while parsing the form data. This causes excessive CPU usage and can make the service unresponsive. The issue arises due to improper handling of null byte characters during URL-encoded form data processing. [1, 3]
How can this vulnerability impact me? :
This vulnerability can cause a denial of service by exhausting the CPU resources of the server running the vulnerable CivetWeb library. Multiple malicious requests with null bytes in the payload can cause the server to enter an infinite loop, making the service unresponsive and unavailable to legitimate users. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for HTTP POST requests containing null byte (\x00) characters in the payload, which trigger an infinite loop in the CivetWeb server's form request handling. Network intrusion detection systems (NIDS) or web server logs can be inspected for such suspicious POST requests. For example, using tcpdump or tshark to capture HTTP POST requests and grep for null bytes can help identify exploit attempts. A sample command to capture such traffic might be: tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep -P '\x00'. Additionally, checking server CPU usage spikes correlated with HTTP POST requests may indicate exploitation attempts. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the CivetWeb library to a version that includes the fix from commit 782e189, which enhances URL decoding validation and aborts processing on malformed input to prevent infinite loops. If updating is not immediately possible, consider implementing network-level filtering to block HTTP POST requests containing null bytes in the payload. Also, monitor and limit the rate of POST requests to reduce the risk of CPU exhaustion. Note that standalone executables pre-built by the vendor are not affected, so using those may be a temporary workaround. [2, 3]