civetweb - Debian Package Tracker

general

source: civetweb (main)
version: 1.16+dfsg-4
maintainer: Debian Med Packaging Team (archive) (DMD) (LowNMU)
uploaders: Andreas Tille [DMD] – Sebastien Jodogne [DMD] [DM] – Étienne Mollier [DMD]
arch: any
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.13+dfsg-5
oldstable: 1.15+dfsg-4
stable: 1.16+dfsg-2+deb13u1
testing: 1.16+dfsg-4
unstable: 1.16+dfsg-4

versioned links

1.13+dfsg-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.15+dfsg-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.16+dfsg-2+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.16+dfsg-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

civetweb
libcivetweb-dev
libcivetweb1

action needed

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.16+dfsg-5, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 7562286db61418a43dd111df331161b5f106bd25
Author: Andreas Tille <tille@debian.org>
Date:   Fri May 22 07:20:35 2026 +0200

    d/rules: Add -DCIVETWEB_ENABLE_X_DOM_SOCKET=ON as requested per https://github.com/root-project/root-ci-images/pull/116

Created: 2026-05-22 Last update: 2026-05-22 07:03

2 low-priority security issues in bookworm low

There are 2 open security issues in bookworm.

2 issues left for the package maintainer to handle:

CVE-2025-9648: (needs triaging) A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests. This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.
CVE-2025-55763: (needs triaging) Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to denial of service or arbitrary code execution.

You can find information about how to handle these issues in the security team's documentation.

Created: 2025-08-30 Last update: 2026-04-28 19:02

debian/patches: 4 patches to forward upstream low

Among the 4 debian patches available in version 1.16+dfsg-4 of the package, we noticed the following issues:

4 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-03-05 18:46

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.3).

Created: 2026-03-31 Last update: 2026-03-31 15:01

news

[rss feed]

[2026-03-10] civetweb 1.16+dfsg-4 MIGRATED to testing (Debian testing watch)
[2026-03-07] Accepted civetweb 1.16+dfsg-2+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Adrian Bunk)
[2026-03-05] Accepted civetweb 1.16+dfsg-4 (source) into unstable (Andreas Tille)
[2025-10-02] civetweb 1.16+dfsg-3 MIGRATED to testing (Debian testing watch)
[2025-09-26] Accepted civetweb 1.16+dfsg-3 (source) into unstable (Andreas Henriksson) (signed by: Alexandre Detiste)
[2024-07-25] civetweb 1.16+dfsg-2 MIGRATED to testing (Debian testing watch)
[2024-07-19] Accepted civetweb 1.16+dfsg-2 (source) into unstable (Étienne Mollier)
[2023-07-29] civetweb 1.16+dfsg-1 MIGRATED to testing (Debian testing watch)
[2023-07-23] Accepted civetweb 1.16+dfsg-1 (source) into unstable (Étienne Mollier)
[2022-11-07] civetweb 1.15+dfsg-4 MIGRATED to testing (Debian testing watch)
[2022-11-01] Accepted civetweb 1.15+dfsg-4 (source) into unstable (Andreas Tille)
[2021-12-13] civetweb 1.15+dfsg-3 MIGRATED to testing (Debian testing watch)
[2021-12-13] civetweb 1.15+dfsg-3 MIGRATED to testing (Debian testing watch)
[2021-12-07] Accepted civetweb 1.15+dfsg-3 (source) into unstable (Andreas Tille)
[2021-12-07] Accepted civetweb 1.15+dfsg-2 (source) into unstable (Andreas Tille)
[2021-10-18] civetweb 1.15+dfsg-1 MIGRATED to testing (Debian testing watch)
[2021-10-13] Accepted civetweb 1.15+dfsg-1 (source) into unstable (Andreas Tille)
[2021-01-27] civetweb 1.13+dfsg-5 MIGRATED to testing (Debian testing watch)
[2021-01-21] Accepted civetweb 1.13+dfsg-5 (source) into unstable (Nilesh Patra)
[2020-12-11] civetweb 1.13+dfsg-4 MIGRATED to testing (Debian testing watch)
[2020-12-05] Accepted civetweb 1.13+dfsg-4 (source) into unstable (Andreas Tille)
[2020-11-09] civetweb 1.13+dfsg-3 MIGRATED to testing (Debian testing watch)
[2020-11-03] Accepted civetweb 1.13+dfsg-3 (source) into unstable (Sebastien Jodogne)
[2020-11-01] civetweb 1.13+dfsg-2 MIGRATED to testing (Debian testing watch)
[2020-10-27] Accepted civetweb 1.13+dfsg-2 (source) into unstable (Sebastien Jodogne)
[2020-10-27] Accepted civetweb 1.13+dfsg-1 (source) into unstable (Andreas Tille)
[2020-10-21] civetweb 1.12+dfsg-5 MIGRATED to testing (Debian testing watch)
[2020-10-16] Accepted civetweb 1.12+dfsg-5 (source) into unstable (Sebastien Jodogne)
[2020-09-24] civetweb 1.12+dfsg-4 MIGRATED to testing (Debian testing watch)
[2020-09-19] Accepted civetweb 1.12+dfsg-4 (source) into unstable (Sebastien Jodogne)

bugs [bug history graph]

all: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.16+dfsg-3