Home / mailings

PDF

[USN-8749-1] CivetWeb vulnerabilities

Posted on 14 September 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-8749-1
September 14, 2026

civetweb vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in CivetWeb.

Software Description:
- civetweb: Embeddable web server with optional CGI, SSL and Lua support

Details:

It was discovered that CivetWeb did not correctly handle parsing certain
URIs. A remote attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-55763)

It was discovered that CivetWeb did not correctly handle parsing certain
HTTP requests. A remote attacker could possibly use this issue to cause
a denial of service. (CVE-2025-9648)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
civetweb 1.16+dfsg-3ubuntu0.1
libcivetweb-dev 1.16+dfsg-3ubuntu0.1
libcivetweb1 1.16+dfsg-3ubuntu0.1

Ubuntu 24.04 LTS
civetweb 1.16+dfsg-1ubuntu0.1
libcivetweb-dev 1.16+dfsg-1ubuntu0.1
libcivetweb1 1.16+dfsg-1ubuntu0.1

Ubuntu 22.04 LTS
civetweb 1.15+dfsg-3ubuntu0.1~esm1
Available with Ubuntu Pro
libcivetweb-dev 1.15+dfsg-3ubuntu0.1~esm1
Available with Ubuntu Pro
libcivetweb1 1.15+dfsg-3ubuntu0.1~esm1
Available with Ubuntu Pro

After a standard system update you need to restart civetweb to make
all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-8749-1
CVE-2025-55763, CVE-2025-9648

Package Information:
https://launchpad.net/ubuntu/+source/civetweb/1.16+dfsg-3ubuntu0.1
https://launchpad.net/ubuntu/+source/civetweb/1.16+dfsg-1ubuntu0.1

--===============0664019462696446344==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP