CVE catalog

CVE-2025-55763

CivetWeb vulnerabilities

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
1.19% · Oct 25, 2026

Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to denial of service or arbitrary code execution.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancivetwebsid1.16+dfsg-6fixed
Debiancivetwebforky1.16+dfsg-6fixed
Debiancivetwebtrixie1.16+dfsg-2+deb13u1fixed
Debiancivetwebbookworm1.15+dfsg-4vulnerable
UbuntucivetwebnobleNot reportedvulnerable
Ubuntucivetwebnoble1.16+dfsg-1ubuntu0.1fixed
Ubuntulibcivetweb-devnoble1.16+dfsg-1ubuntu0.1fixed
Ubuntulibcivetweb1noble1.16+dfsg-1ubuntu0.1fixed
Ubuntucivetwebpro1.13+dfsg-5vulnerable
Ubuntucivetwebpro1.15+dfsg-1vulnerable
Ubuntucivetwebpro1.15+dfsg-3vulnerable
Ubuntucivetwebpro1.15+dfsg-3ubuntu0.1~esm1fixed
Ubuntucivetweb24.041.16+dfsg-1vulnerable
Ubuntucivetweb24.041.16+dfsg-1build1vulnerable
Ubuntucivetweb24.041.16+dfsg-1ubuntu0.1fixed
Ubuntucivetweb26.041.16+dfsg-2vulnerable
Ubuntucivetweb26.041.16+dfsg-3vulnerable
Ubuntucivetweb26.041.16+dfsg-3ubuntu0.1fixed
Opensusecivetwebtumbleweed1.6+git1776611085.588860e3-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancivetwebsourcesid1.16+dfsg-3not yet assignedNot reported[1112507]
Debiancivetwebsourceforky1.16+dfsg-3not yet assignedNot reported[1112507]
Debiancivetwebsourcetrixie1.16+dfsg-2+deb13u1not yet assignedNot reported[1112507]
Debiancivetwebsourcebookworm(unfixed)not yet assignedNot reported[1112507]
Ubuntucivetwebdebnoble1.16+dfsg-1ubuntu0.1Not reportedNot reportedNot reported
Ubuntulibcivetweb-devdebnoble1.16+dfsg-1ubuntu0.1Not reportedNot reportedNot reported
Ubuntulibcivetweb1debnoble1.16+dfsg-1ubuntu0.1Not reportedNot reportedNot reported
Ubuntucivetwebdebpro1.15+dfsg-3ubuntu0.1~esm1Not reportedUSN-8749-1Not reported
Ubuntucivetwebdeb24.041.16+dfsg-1ubuntu0.1Not reportedUSN-8749-1Not reported
Ubuntucivetwebdeb26.041.16+dfsg-3ubuntu0.1Not reportedUSN-8749-1Not reported
Opensusecivetwebrpmtumbleweed1.6+git1776611085.588860e3-1.1Not reportedOPENSUSE-SU-2026:10818-1Not reported

[Debian bug #1112507]

Notes

[bookworm] civetweb: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [civetweb]Affected
    Details (2)

    • 1.15+dfsg-4 · amd64 · bookworm

      Affected

      usn · civetweb · debian · bookworm; usn · civetweb · debian · 12

    • 1.15+dfsg-4 · arm64 · bookworm

      Affected

      usn · civetweb · debian · bookworm; usn · civetweb · debian · 12

  • [libcivetweb1]Affected

    Source package: [civetweb]

    Details (2)

    • 1.15+dfsg-4 · amd64 · bookworm

      Affected

      usn · civetweb · debian · bookworm; usn · civetweb · debian · 12

    • 1.15+dfsg-4 · arm64 · bookworm

      Affected

      usn · civetweb · debian · bookworm; usn · civetweb · debian · 12

  • [libcivetweb-dev]Affected

    Source package: [civetweb]

    Details (2)

    • 1.15+dfsg-4 · amd64 · bookworm

      Affected

      usn · civetweb · debian · bookworm; usn · civetweb · debian · 12

    • 1.15+dfsg-4 · arm64 · bookworm

      Affected

      usn · civetweb · debian · bookworm; usn · civetweb · debian · 12

[openSUSE Tumbleweed]

  • [civetweb-devel]Unknown

    Source package: [civetweb]

    Details (1)

    • 1.6+git1776611085.588860e3-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 1.6+git1776611085.588860e3-1.1

      Version impact unknown

      usn · civetweb · opensuse · tumbleweed

  • [libcivetweb1_16_0]Unknown

    Source package: [civetweb]

    Details (1)

    • 1.6+git1776611085.588860e3-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 1.6+git1776611085.588860e3-1.1

      Version impact unknown

      usn · civetweb · opensuse · tumbleweed

  • [libcivetweb-cpp1_16_0]Unknown

    Source package: [civetweb]

    Details (1)

    • 1.6+git1776611085.588860e3-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 1.6+git1776611085.588860e3-1.1

      Version impact unknown

      usn · civetweb · opensuse · tumbleweed

  • [civetweb]Fixed

    Source package: [civetweb]

    Details (1)

    • 1.6+git1776611085.588860e3-1.3 · x86_64 · tumbleweed

      Fixed · Fixed: 1.6+git1776611085.588860e3-1.1

      usn · civetweb · opensuse · tumbleweed

[Debian 13 (Trixie)]

  • [civetweb]Fixed
    Details (2)

    • 1.16+dfsg-2+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.16+dfsg-2+deb13u1

      usn · civetweb · debian · 13

    • 1.16+dfsg-2+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.16+dfsg-2+deb13u1

      usn · civetweb · debian · 13

  • [libcivetweb1]Fixed

    Source package: [civetweb]

    Details (2)

    • 1.16+dfsg-2+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.16+dfsg-2+deb13u1

      usn · civetweb · debian · 13

    • 1.16+dfsg-2+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.16+dfsg-2+deb13u1

      usn · civetweb · debian · 13

  • [libcivetweb-dev]Fixed

    Source package: [civetweb]

    Details (2)

    • 1.16+dfsg-2+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.16+dfsg-2+deb13u1

      usn · civetweb · debian · 13

    • 1.16+dfsg-2+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.16+dfsg-2+deb13u1

      usn · civetweb · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]