CVE-2025-57785

MEDIUM

Hiawatha.leisink Hiawatha Webserver - Double Free

Title source: rule

Description

A Double Free in XSLT `show_index` has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated attacker to corrupt data which may lead to arbitrary code execution.

References (1)

Scores

CVSS v3 6.5
EPSS 0.0013
EPSS Percentile 31.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Classification

CWE
CWE-415
Status published

Affected Products (1)

hiawatha.leisink/hiawatha_webserver

Timeline

Published Jan 26, 2026
Tracked Since Feb 18, 2026