CVE-2025-9648: CivetWeb Library DoS Vulnerability

CVE-2025-9648 Overview

A denial of service vulnerability exists in the CivetWeb embedded web server library's mg_handle_form_request function. Remote attackers can trigger an infinite loop by sending a crafted HTTP POST request containing a null byte in the payload. The server consumes CPU resources during form data parsing and becomes unresponsive to legitimate traffic after multiple malicious requests. The flaw stems from improper handling of null bytes in URL-encoded form data, classified as [CWE-158] (Improper Neutralization of Null Byte or NUL Character). The issue was fixed in commit 782e189. Only applications that link against the CivetWeb library are affected. The standalone executable pre-built by the vendor does not contain the vulnerable code path.

Critical Impact

Unauthenticated remote attackers can exhaust CPU resources and render CivetWeb-based services unresponsive by sending crafted HTTP POST requests with embedded null bytes.

Affected Products

• CivetWeb library (versions prior to commit 782e189)
• Applications embedding the CivetWeb library for HTTP form handling
• CivetWeb standalone executable pre-built by the vendor is NOT affected

Discovery Timeline

• 2025-09-29 - CVE-2025-9648 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-9648

Vulnerability Analysis

The vulnerability resides in the mg_handle_form_request function within src/civetweb.c. This function parses URL-encoded form data submitted via HTTP POST requests. When the parser encounters a null byte (\0) within the form payload, the parsing loop fails to advance past the offending character. The function enters an infinite loop and pins a CPU core at 100% utilization.

Each malicious request consumes one worker thread. An attacker who issues multiple requests in parallel exhausts the available worker pool. The web server stops responding to legitimate HTTP traffic, achieving denial of service without authentication.

The vulnerability does not affect data confidentiality or integrity. It targets availability only, consistent with the CVSS vector indicating high availability impact and no confidentiality or integrity impact.

Root Cause

The parser does not correctly neutralize null bytes in URL-encoded form input. URL-encoded data may contain a %00 sequence, which the decoder converts to a null byte. The subsequent parsing loop relies on string boundaries that the null byte disrupts, causing the loop counter to stall.

Attack Vector

An unauthenticated remote attacker sends an HTTP POST request with Content-Type: application/x-www-form-urlencoded and a body containing %00 within form field values. The attack requires no user interaction and no privileges. The attacker repeats the request to exhaust worker threads.

// Source: https://github.com/civetweb/civetweb/commit/782e18903515f43bafbf2e668994e82bdfa51133
// Patch in src/civetweb.c - "Make parsing of URL encoded forms more robust"
-/* Copyright (c) 2013-2024 the Civetweb developers
+/* Copyright (c) 2013-2025 the Civetweb developers
  * Copyright (c) 2004-2013 Sergey Lyubka
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy

The full patch hardens the form parser so null bytes no longer stall the parsing loop. Refer to the CivetWeb Commit Changes and CivetWeb GitHub Issue #1348 for full technical context.

Detection Methods for CVE-2025-9648

Indicators of Compromise

• HTTP POST requests containing %00 sequences within URL-encoded form bodies from external sources
• Sustained 100% CPU utilization on one or more CivetWeb worker threads without corresponding response traffic
• Increased TCP connections in ESTABLISHED state to the CivetWeb listener with no application-layer responses
• Web server logs showing accepted POST requests with no matching completion entries

Detection Strategies

• Inspect HTTP request bodies at a web application firewall or reverse proxy for %00 byte sequences in application/x-www-form-urlencoded payloads
• Monitor process-level CPU consumption for CivetWeb-embedded applications and alert on sustained spikes
• Correlate accepted POST requests with response status codes; alert when responses are not emitted within an expected window
• Track worker thread counts and queue depth to detect exhaustion patterns

Monitoring Recommendations

• Forward CivetWeb access logs and host CPU telemetry to a centralized log platform for correlation
• Establish baselines for normal POST request volume and CPU usage per service, then alert on deviations
• Enable rate limiting at the reverse proxy layer for unauthenticated POST endpoints
• Periodically scan dependency manifests to identify applications that statically link the vulnerable CivetWeb library

How to Mitigate CVE-2025-9648

Immediate Actions Required

• Identify all applications embedding the CivetWeb library and update them to a build that includes commit 782e189 or later
• Rebuild and redeploy dependent applications, as the fix is in the library source rather than a binary patch
• Restrict network exposure of CivetWeb-based services to trusted networks where feasible
• Deploy WAF rules that reject HTTP POST bodies containing %00 in URL-encoded form data

Patch Information

The vulnerability is fixed in CivetWeb commit 782e18903515f43bafbf2e668994e82bdfa51133, titled "Make parsing of URL encoded forms more robust." Application maintainers must pull the patched source, recompile, and redistribute. The vendor's pre-built standalone executable does not invoke the vulnerable code path and does not require updating. See the CERT Poland CVE Advisory for additional vendor coordination details.

Workarounds

• Place a reverse proxy in front of CivetWeb services that strips or rejects requests containing %00 in form bodies
• Disable HTTP form handling endpoints that are not required by the application
• Apply per-source-IP rate limiting on POST endpoints to slow exploitation attempts
• Set aggressive request timeouts at the proxy layer so stalled worker threads are reaped by upstream cancellation

# Example nginx reverse proxy rule to block null bytes in POST bodies
location / {
    if ($request_method = POST) {
        if ($request_body ~* "%00") {
            return 400;
        }
    }
    proxy_pass http://civetweb_backend;
    proxy_read_timeout 10s;
    proxy_send_timeout 10s;
}