What’s Vulnerable › Vulnerabilities

CVE-2025-13826: Incorrect input validation on the Zervit portable HTTP/Web server

• Severity: high (CVSS 8.2 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-21 · updated 2026-10-11
• Weakness: CWE-20

Description

Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is caused by inadequate validation of user-supplied input. An attacker can exploit this vulnerability by sending malicious requests. If the vulnerability is successfully exploited, the application can be made to stop responding, resulting in a DoS condition. It is possible to manually restart the application.

Affected products

• Zervit portable HTTP/Web server: 0

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-input-validation-zervit-portable-httpweb-server

Get alerted when CVE-2025-13826 or the next vulnerability affects your stack