Vulnerability · Published Aug 29, 2025 · Assigned by mitre
CVE-2025-55763
High 7.5
In plain English
A high-severity stack buffer overflow in the civetweb package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to denial of service or arbitrary code execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | civetweb | no fix listed | DEBIAN-CVE-2025-55763 |
| Debian:13 | civetweb | 1.16+dfsg-2+deb13u1 | DEBIAN-CVE-2025-55763 |
| Debian:14 | civetweb | 1.16+dfsg-3 | DEBIAN-CVE-2025-55763 |
| Ubuntu:24.04:LTS | civetweb | 1.16+dfsg-1ubuntu0.1 | USN-8749-1 |
| Ubuntu:24.04:LTS | civetweb | 1.16+dfsg-1ubuntu0.1 | UBUNTU-CVE-2025-55763 |
| Ubuntu:25.10 | civetweb | no fix listed | UBUNTU-CVE-2025-55763 |
| Ubuntu:26.04:LTS | civetweb | 1.16+dfsg-3 | UBUNTU-CVE-2025-55763 |
| Ubuntu:26.04:LTS | civetweb | 1.16+dfsg-3ubuntu0.1 | USN-8749-1 |
| Ubuntu:26.10 | civetweb | 1.16+dfsg-3 | UBUNTU-CVE-2025-55763 |
Affected products (as reported)
Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H