GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libmicrohttpd-docUpgrade libmicrohttpd-develUpgrade libmicrohttpd | Nov 16, 2023 | Feb 28, 2023 |
| Amazon Linux Ami 2 | — | Upgrade libmicrohttpdUpgrade libmicrohttpd-develUpgrade libmicrohttpd-debuginfoUpgrade libmicrohttpd-doc | Jul 21, 2023 | Feb 28, 2023 |
| Amazon_linux_2023 | — | Upgrade libmicrohttpd-debuginfoUpgrade libmicrohttpd-docUpgrade libmicrohttpdUpgrade libmicrohttpd-develUpgrade libmicrohttpd-debugsource | Aug 5, 2025 | Feb 28, 2023 |
| Centos_linux | — | Upgrade libmicrohttpd-debugsourceUpgrade libmicrohttpdUpgrade libmicrohttpd-debuginfo | Nov 8, 2023 | Feb 28, 2023 |
| Debian | — | Upgrade libmicrohttpd | Apr 3, 2023 | Feb 28, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libmicrohttpd | Feb 12, 2024 | Feb 28, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libmicrohttpd | Jan 10, 2024 | Feb 28, 2023 |
| Oracle_linux | — | Upgrade libmicrohttpdUpgrade libmicrohttpd-docUpgrade libmicrohttpd-devel | Nov 22, 2023 | Feb 28, 2023 |
| Redhat_linux | — | Upgrade libmicrohttpdUpgrade libmicrohttpd-develUpgrade libmicrohttpd-debugsourceNo solution existsUpgrade libmicrohttpd-debuginfoUpgrade libmicrohttpd-doc | Nov 8, 2023 | Feb 28, 2023 |
| Rocky_linux | — | Upgrade libmicrohttpd-debugsourceUpgrade libmicrohttpdUpgrade libmicrohttpd-debuginfoUpgrade libmicrohttpd-devel | Jun 29, 2026 | Jun 25, 2026 |
| Suse | — | Upgrade libmicrohttpd-develUpgrade libmicrohttpd12Upgrade libmicrohttpd10 | Mar 30, 2023 | Feb 28, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 28, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub