[Debian-med-packaging] Bug#1118285: civetweb: CVE-2025-9648

[Salvatore Bonaccorso]

Source: civetweb
Version: 1.16+dfsg-3
Severity: important
Tags: security upstream
Forwarded: https://github.com/civetweb/civetweb/issues/1348
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
Control: found -1 1.16+dfsg-2

Hi,

The following vulnerability was published for civetweb.

CVE-2025-9648[0]:
| A vulnerability in the CivetWeb library's function
| mg_handle_form_request allows remote attackers to trigger a denial
| of service (DoS) condition. By sending a specially crafted HTTP POST
| request containing a null byte in the payload, the server enters an
| infinite loop during form data parsing. Multiple malicious requests
| will result in complete CPU exhaustion and render the service
| unresponsive to further requests.  This issue was fixed in commit
| 782e189. This issue affects only the library, standalone executable
| pre-built by vendor is not affected.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-9648
    https://www.cve.org/CVERecord?id=CVE-2025-9648
[1] https://github.com/civetweb/civetweb/issues/1348
[2] https://github.com/civetweb/civetweb/commit/782e18903515f43bafbf2e668994e82bdfa51133

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore