CVE-2023-27371 is a medium-severity denial-of-service vulnerability affecting GNU libmicrohttpd versions prior to 0.9.76. An unauthenticated remote attacker can exploit improper parsing of multipart/form-data boundaries by sending a crafted HTTP POST request containing null bytes in the boundary field. This can lead to an out-of-bounds read and a crash, effectively causing a denial of service. There is currently no public exploit code available, nor is there evidence of active exploitation or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.9.76CPE matchmatch criteria | cpe:2.3:a:gnu:libmicrohttpd:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
libmicrohttpd: remote DoS
Feb 28, 2023GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.
Feb 14, 2023