CVE-2025-9648 in CivetWeb library allows remote DoS via crafted HTTP POST with null byte…

29 September 2025 high vulnerability

CVE-2025-9648 in CivetWeb library allows remote DoS via crafted HTTP POST with null byte, causing infinite loop and CPU exhaustion; fixed in commit 782e189.

CERT Polska coordinated disclosure of CVE-2025-9648, a denial-of-service vulnerability in the CivetWeb library. The flaw resides in the mg_handle_form_request function, where processing a specially crafted HTTP POST request containing a null byte in the payload triggers an infinite loop during form data parsing. Multiple exploitation attempts lead to complete CPU exhaustion, rendering the affected service unresponsive.

The vulnerability affects only the CivetWeb library itself; standalone executables pre-built by the vendor are not impacted. The issue has been remediated in commit 782e189. Organizations using the CivetWeb library in custom applications should update to a patched version immediately.

This disclosure follows responsible reporting by Artur Łącki and CERT Polska's coordinated vulnerability disclosure process. The low complexity of exploitation and the availability of technical details increase the likelihood of active scanning or exploitation attempts against unpatched library implementations.

Mentioned in this report

Vulnerabilities CVE-2025-9648

Detection guidance

Suspicious HTTP POST with Null Byte Targeting CivetWeb Form Parser (CVE-2025-9648)

ATT&CK T1499.004

Detects HTTP POST requests with multipart/form-data content containing a null byte in the URI or body, matching the crafted payload pattern that triggers an infinite loop in CivetWeb's mg_handle_form_request function. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious HTTP POST with Null Byte Targeting CivetWeb Form Parser
id: daad1bf0-b65d-5685-8ef2-0e490c344ba1
status: experimental
description: 'Detects HTTP POST requests carrying multipart/form-data payloads that
  contain an embedded null byte,

  matching the exploitation pattern for CVE-2025-9648 in the CivetWeb library where
  a crafted null byte

  in a form-data POST body triggers an infinite loop in mg_handle_form_request, leading
  to CPU exhaustion

  and denial of service. Repeated occurrences from the same source in a short window
  strongly indicate

  active exploitation attempts rather than a single anomalous request.

  '
references:
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9648
author: Vorant
tags:
- attack.t1499.004
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
  contenttype:
    cs-uri-query|contains:
    - '%00'
    cs-method: POST
  nullbyte_body:
  - request|contains: \x00
  - request|contains: '%00'
  filter:
    cs-uri-query|contains:
    - boundary=
    - multipart
  condition: selection and (contenttype or nullbyte_body)
falsepositives:
- Legitimate clients or automated testing tools sending malformed encoded query strings
  containing literal '%00' sequences for unrelated reasons
- Web application vulnerability scanners performing fuzzing against multipart form
  endpoints
level: medium

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2025/09/CVE-2025-9648

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free