GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libmicrohttpdUpgrade libmicrohttpd-develUpgrade libmicrohttpd-doc | Nov 16, 2023 | Feb 28, 2023 |
| Amazon Linux Ami 2 | — | Upgrade libmicrohttpd-docUpgrade libmicrohttpd-debuginfoUpgrade libmicrohttpd-develUpgrade libmicrohttpd | Jul 21, 2023 | Feb 28, 2023 |
| Amazon_linux_2023 | — | Upgrade libmicrohttpd-debugsourceUpgrade libmicrohttpd-develUpgrade libmicrohttpdUpgrade libmicrohttpd-debuginfoUpgrade libmicrohttpd-doc | Aug 5, 2025 | Feb 28, 2023 |
| Centos_linux | — | Upgrade libmicrohttpd-debugsourceUpgrade libmicrohttpdUpgrade libmicrohttpd-debuginfo | Nov 8, 2023 | Feb 28, 2023 |
| Debian | — | Upgrade libmicrohttpd | Apr 3, 2023 | Feb 28, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libmicrohttpd | Feb 12, 2024 | Feb 28, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libmicrohttpd | Jan 10, 2024 | Feb 28, 2023 |
| Oracle_linux | — | Upgrade libmicrohttpdUpgrade libmicrohttpd-develUpgrade libmicrohttpd-doc | Nov 22, 2023 | Feb 28, 2023 |
| Redhat_linux | — | Upgrade libmicrohttpdUpgrade libmicrohttpd-debuginfoUpgrade libmicrohttpd-develUpgrade libmicrohttpd-docUpgrade libmicrohttpd-debugsourceNo solution exists | Nov 8, 2023 | Feb 28, 2023 |
| Rocky_linux | — | Upgrade libmicrohttpd-debugsourceUpgrade libmicrohttpdUpgrade libmicrohttpd-debuginfoUpgrade libmicrohttpd-devel | Jun 29, 2026 | Jun 25, 2026 |
| Suse | — | Upgrade libmicrohttpd10Upgrade libmicrohttpd12Upgrade libmicrohttpd-devel | Mar 30, 2023 | Feb 28, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 28, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub