{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-9648",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-9648",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-09-29T11:47:56.141Z",
    "updatedAt": "2025-09-29T12:53:45.646Z",
    "importedAt": "2026-10-24T01:57:44.935Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Denial of Service in CivetWeb",
      "summary": "A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests.\n\nThis issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.",
      "affected": [
        {
          "vendor": "CivetWeb",
          "product": "CivetWeb",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "1.08"
            },
            {
              "version": "1.08",
              "status": "unknown",
              "versionType": "semver",
              "lessThan": "1.10"
            },
            {
              "version": "1.10",
              "status": "affected",
              "versionType": "semver",
              "lessThanOrEqual": "1.16"
            }
          ]
        }
      ]
    }
  }
}