Cyber Resilience

CVE-2025-9648

Published
29 September 2025
Modified
15 April 2026
CVSS Score v4 8.7
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0071 50th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-9648 is a high-severity Improper Neutralization of Null Byte or NUL Character (CWE-158) vulnerability in Cert (inferred from references). Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 50th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

The vulnerability CVE-2025-9648 resides in the CivetWeb library's mg_handle_form_request function and stems from improper handling of null bytes during form data parsing. It affects the library when processing specially crafted HTTP POST requests, but does not impact pre-built standalone executables distributed by the vendor.

An unauthenticated remote attacker can exploit the flaw by sending a malicious HTTP POST payload containing a null byte, which forces the server into an infinite loop. Repeated requests lead to full CPU exhaustion and render the service unavailable, resulting in a denial of service with a CVSS score of 8.7.

The issue was resolved in commit 782e189, as documented in the project's GitHub repository and associated issue tracker along with guidance from cert.pl.

EU & UK References

Vulnerability Data

A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop…

more

during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests. This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.

CWE(s)
CWE-158

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

CVE enables remote exploitation of public-facing web app (CivetWeb) via crafted POST to trigger application-layer DoS via infinite loop/CPU exhaustion.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-33191Shared CWE-158
CVE-2026-4359Shared CWE-158
CVE-2025-61985Shared CWE-158
CVE-2025-47812Shared CWE-158
CVE-2025-66263Shared CWE-158
CVE-2025-14388Shared CWE-158
CVE-2026-47778Shared CWE-158
CVE-2009-1537Shared CWE-158
CVE-2024-10921Shared CWE-158
CVE-2024-0408Shared CWE-158

Affected Assets

Cert
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SC-5 Denial-of-service Protection
  • SI-2 Flaw Remediation
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.2.10

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly enforces validation of HTTP POST form data to reject malformed inputs such as embedded null bytes before mg_handle_form_request parsing begins.

SC-5 Denial-of-service Protection good match
prevent

Implements resource management and request throttling to bound CPU consumption and block the infinite-loop DoS from exhausting the CivetWeb service.

SI-2 Flaw Remediation partial match
prevent

Requires prompt application of the upstream fix (commit 782e189) that corrects the null-byte handling flaw in the library.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require input neutralization and validation to prevent null-byte flaws.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing can detect null-byte flaws but does not itself implement the neutralization.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle mandates input validation and sanitization that directly prevents null-byte injection.

A.8.26 Application security requirements partial match
prevents

Application security requirements include explicit rules for neutralizing dangerous characters such as NUL.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles reduce the likelihood of unsafe data flows but do not prescribe character neutralization.

A.8.28 Secure coding partial match
prevents

Secure coding standards explicitly require proper neutralization of null bytes and other metacharacters.

References