Critical Flaws in Hiawatha Web Server Could Allow Authentication Bypass and RCE

According to CERT/CC, three serious flaws in the Hiawatha web server could allow authentication bypass, session hijacking and remote code execution.

The first vulnerability, CVE-2025-57783, is a request smuggling flaw caused by improper header parsing in the fetch_request function of versions 8.5 through 11.7, with CERT/CC explaining that “This vulnerability allows an unauthenticated attacker to smuggle requests and access restricted resources managed by the server.” The second flaw, CVE-2025-57784, affects the Tomahawk

management component and arises from insecure use of the strcmp function in the handle_admin function; CERT/CC notes that this vulnerability “allows a local attacker to access the management client” by timing the failed login attempts.

The third flaw, CVE-2025-57785, impacts versions 10.8.2 through 11.7 and is described as a “double free in the XSLT show_index function… may result in corrupt data leading to the execution of arbitrary code.” CERT/CC emphasises the risks, urging administrators to apply the updated version when released and to minimise exposure of Hiawatha servers to untrusted networks while monitoring for suspicious traffic.