USN-8749-1: CivetWeb vulnerabilities
Ubuntu USN-8749-1 patches CivetWeb URI and HTTP request parsing flaws enabling remote DoS or possible code execution.
Ubuntu Security Notice USN-8749-1 addresses two CivetWeb vulnerabilities. CVE-2025-55763 involves incorrect URI parsing that could allow a remote attacker to cause denial of service or execute arbitrary code, affecting Ubuntu 22.04 LTS and 24.04 LTS. CVE-2025-9648 involves incorrect HTTP request parsing enabling remote denial of service.
- CVE-2025-55763: remote attacker could execute code via crafted URI parsing
- CVE-2025-9648: remote denial of service via crafted HTTP requests
- Only Ubuntu 22.04 LTS and 24.04 LTS affected by CVE-2025-55763
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-55763 | Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request | 7.5 | 1% | PoC | |
| CVE-2025-9648 | A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition | 8.7 | <1% |
From the original article
It was discovered that CivetWeb did not correctly handle parsing certain URIs. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.