CVE-2025-55763
published 2025-08-29CVE-2025-55763: Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.19%
67.7th percentile
Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to denial of service or arbitrary code execution.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| civetweb_project | civetweb | >= 0 < 1.16+dfsg-2+deb13u1 | 1.16+dfsg-2+deb13u1 |
| civetweb_project | civetweb | >= 0 < 1.16+dfsg-3 | 1.16+dfsg-3 |
| civetweb_project | civetweb | 1.14 – 1.16 | — |
| debian | civetweb | < civetweb 1.16+dfsg-3 (forky) | civetweb 1.16+dfsg-3 (forky) |
| ubuntu | civetweb | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
CivetWeb vulnerabilities
vendor_ubuntu·2026-09-14·CVSS 7.5
CVE-2025-9648 [HIGH] CivetWeb vulnerabilities
Title: CivetWeb vulnerabilities
Summary: Several security issues were fixed in CivetWeb.
It was discovered that CivetWeb did not correctly handle parsing certain
URIs. A remote attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-55763)
It was discovered that CivetWeb did not correctly handle parsing certain
HTTP requests. A remote attacker could possibly use this issue to cause
a denial of service. (CVE-2025-9648)
Instructions: After a standard system update you need to restart civetweb to make
all the necessary changes.
Debian
CVE-2025-55763: civetweb - Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows ...
vendor_debian·2025·CVSS 7.5
CVE-2025-55763 [HIGH] CVE-2025-55763: civetweb - Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows ...
Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to denial of service or arbitrary code execution.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 1.16+dfsg-3)
sid: resolved (fixed in 1.16+dfsg-3)
trixie: resolved (fixed in 1.16+dfsg-2+deb13u1)
GHSA
GHSA-2757-2hpv-v482: Buffer Overflow in the URI parser of CivetWeb 1
ghsa_unreviewed·2025-08-29
CVE-2025-55763 [HIGH] CWE-121 GHSA-2757-2hpv-v482: Buffer Overflow in the URI parser of CivetWeb 1
Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to denial of service or arbitrary code execution.
OSV
CVE-2025-55763: Buffer Overflow in the URI parser of CivetWeb 1
osv·2025-08-29·CVSS 7.5
CVE-2025-55763 [HIGH] CVE-2025-55763: Buffer Overflow in the URI parser of CivetWeb 1
Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to denial of service or arbitrary code execution.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-08-29
Published