CVE-2025-13826
Remote DoS via Input Validation Flaw in Zervit HTTP Server
Publication date: 2026-04-21
Last updated on: 2026-04-21
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zervit | portable_http_web_server | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-13826 is a high-severity vulnerability in the Zervit portable HTTP/web server caused by improper validation of user-supplied input related to configuration reset requests.
An attacker can exploit this vulnerability by sending specially crafted malicious requests that cause the server application to stop responding, resulting in a remote Denial of Service (DoS) condition.
The vulnerability does not require any privileges, user interaction, or client-side complexity to exploit, and the affected application can be manually restarted after exploitation.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should monitor the Zervit portable HTTP/web server for any signs of service disruption caused by malicious configuration reset requests.
If the application stops responding due to exploitation, a manual restart of the application is possible and should be performed promptly to restore service.
Since no patch or solution is currently available, it is important to restrict access to the server to trusted users and networks to reduce the risk of exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for malicious configuration reset requests sent to the Zervit portable HTTP/web server. Since the vulnerability is triggered by specially crafted input causing the server to stop responding, detection involves identifying unusual or malformed reset requests targeting the server.
Specific commands are not provided in the available resources. However, network administrators can use packet capture tools like tcpdump or Wireshark to filter HTTP requests to the server and look for suspicious reset requests. For example, a tcpdump command to capture HTTP traffic to the server might be:
- tcpdump -i <interface> tcp port 80 and host <server_ip>
Analyzing captured traffic for unusual or malformed configuration reset requests could help detect exploitation attempts. Additionally, monitoring the server's responsiveness and logs for unexpected crashes or stops can indicate an attack.
How can this vulnerability impact me? :
If exploited, this vulnerability can cause the Zervit portable HTTP/web server to stop responding, leading to a Denial of Service (DoS) condition.
This means that legitimate users will be unable to access the services provided by the server until it is manually restarted.
Such service disruption can affect availability and reliability of applications relying on this server.