civetweb - Debian Package Tracker

general

source: civetweb (main)
version: 1.16+dfsg-3
maintainer: Debian Med Packaging Team (archive) (DMD) (LowNMU)
uploaders: Andreas Tille [DMD] – Sebastien Jodogne [DMD] [DM] – Étienne Mollier [DMD]
arch: any
std-ver: 4.7.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.13+dfsg-5
oldstable: 1.15+dfsg-4
stable: 1.16+dfsg-2
testing: 1.16+dfsg-3
unstable: 1.16+dfsg-3

versioned links

1.13+dfsg-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.15+dfsg-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.16+dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.16+dfsg-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

civetweb
libcivetweb-dev
libcivetweb1

action needed

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2025-9648: A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests. This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.

Created: 2025-09-30 Last update: 2025-10-17 23:03

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2025-9648: A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests. This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.

Created: 2025-08-30 Last update: 2025-10-17 23:03

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.16+dfsg-4, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 0906189a68bb2d11bedad9757a1699c92b856ccf
Author: Andreas Tille <tille@debian.org>
Date:   Thu Mar 5 13:25:59 2026 +0100

    Turn into real release

commit 92e44ee84e67433cc1118c862666c8d4d9256f91
Author: Andreas Tille <tille@debian.org>
Date:   Thu Mar 5 13:25:02 2026 +0100

    Import patch by Andrian Bunk

commit 51452b62eff4551073d83e65765e37869e31d52c
Author: Alexandre Detiste <tchet@debian.org>
Date:   Sat Sep 27 01:18:45 2025 +0200

    close 2nd bug

Created: 2025-09-27 Last update: 2026-03-05 13:31

2 low-priority security issues in trixie low

There are 2 open security issues in trixie.

2 issues left for the package maintainer to handle:

CVE-2025-9648: (needs triaging) A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests. This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.
CVE-2025-55763: (needs triaging) Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to denial of service or arbitrary code execution.

You can find information about how to handle these issues in the security team's documentation.

Created: 2025-08-30 Last update: 2025-10-17 23:03

2 low-priority security issues in bookworm low

There are 2 open security issues in bookworm.

2 issues left for the package maintainer to handle:

CVE-2025-9648: (needs triaging) A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests. This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.
CVE-2025-55763: (needs triaging) Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to denial of service or arbitrary code execution.

You can find information about how to handle these issues in the security team's documentation.

Created: 2025-08-30 Last update: 2025-10-17 23:03

debian/patches: 3 patches to forward upstream low

Among the 3 debian patches available in version 1.16+dfsg-3 of the package, we noticed the following issues:

3 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2025-09-27 15:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.3 instead of 4.7.0).

Created: 2025-02-21 Last update: 2025-12-23 20:00

news

[rss feed]

[2026-03-05] Accepted civetweb 1.16+dfsg-4 (source) into unstable (Andreas Tille)
[2025-10-02] civetweb 1.16+dfsg-3 MIGRATED to testing (Debian testing watch)
[2025-09-26] Accepted civetweb 1.16+dfsg-3 (source) into unstable (Andreas Henriksson) (signed by: Alexandre Detiste)
[2024-07-25] civetweb 1.16+dfsg-2 MIGRATED to testing (Debian testing watch)
[2024-07-19] Accepted civetweb 1.16+dfsg-2 (source) into unstable (Étienne Mollier)
[2023-07-29] civetweb 1.16+dfsg-1 MIGRATED to testing (Debian testing watch)
[2023-07-23] Accepted civetweb 1.16+dfsg-1 (source) into unstable (Étienne Mollier)
[2022-11-07] civetweb 1.15+dfsg-4 MIGRATED to testing (Debian testing watch)
[2022-11-01] Accepted civetweb 1.15+dfsg-4 (source) into unstable (Andreas Tille)
[2021-12-13] civetweb 1.15+dfsg-3 MIGRATED to testing (Debian testing watch)
[2021-12-13] civetweb 1.15+dfsg-3 MIGRATED to testing (Debian testing watch)
[2021-12-07] Accepted civetweb 1.15+dfsg-3 (source) into unstable (Andreas Tille)
[2021-12-07] Accepted civetweb 1.15+dfsg-2 (source) into unstable (Andreas Tille)
[2021-10-18] civetweb 1.15+dfsg-1 MIGRATED to testing (Debian testing watch)
[2021-10-13] Accepted civetweb 1.15+dfsg-1 (source) into unstable (Andreas Tille)
[2021-01-27] civetweb 1.13+dfsg-5 MIGRATED to testing (Debian testing watch)
[2021-01-21] Accepted civetweb 1.13+dfsg-5 (source) into unstable (Nilesh Patra)
[2020-12-11] civetweb 1.13+dfsg-4 MIGRATED to testing (Debian testing watch)
[2020-12-05] Accepted civetweb 1.13+dfsg-4 (source) into unstable (Andreas Tille)
[2020-11-09] civetweb 1.13+dfsg-3 MIGRATED to testing (Debian testing watch)
[2020-11-03] Accepted civetweb 1.13+dfsg-3 (source) into unstable (Sebastien Jodogne)
[2020-11-01] civetweb 1.13+dfsg-2 MIGRATED to testing (Debian testing watch)
[2020-10-27] Accepted civetweb 1.13+dfsg-2 (source) into unstable (Sebastien Jodogne)
[2020-10-27] Accepted civetweb 1.13+dfsg-1 (source) into unstable (Andreas Tille)
[2020-10-21] civetweb 1.12+dfsg-5 MIGRATED to testing (Debian testing watch)
[2020-10-16] Accepted civetweb 1.12+dfsg-5 (source) into unstable (Sebastien Jodogne)
[2020-09-24] civetweb 1.12+dfsg-4 MIGRATED to testing (Debian testing watch)
[2020-09-19] Accepted civetweb 1.12+dfsg-4 (source) into unstable (Sebastien Jodogne)
[2020-09-17] Accepted civetweb 1.12+dfsg-2 (source) into unstable (Andreas Tille)
[2020-09-16] Accepted civetweb 1.12+dfsg-1 (source amd64) into unstable, unstable (Debian FTP Masters) (signed by: Andreas Tille)

bugs [bug history graph]

all: 1
RC: 0
I&N: 0
M&W: 0
F&P: 1
patch: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.16+dfsg-3