GNU Libmicrohttpd vulnerabilities

6 CVEs affecting GNU Libmicrohttpd, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-62689, published 2025-11-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-3466, published 2021-03-25. Critical severity, CVSS 9.8. EPSS: 8.7% chance of exploitation in the next 30 days. A flaw was found in libmicrohttpd. A missing bounds check in the post_process_urlencoded function leads to a buffer overflow, allowing a remote attacker to write arbitrary data in an application that…
CVE-2013-7039, published 2013-12-13. Medium severity, CVSS 5.1. EPSS: 3.3% chance of exploitation in the next 30 days. Stack-based buffer overflow in the MHD_digest_auth_check function in libmicrohttpd before 0.9.32, when MHD_OPTION_CONNECTION_MEMORY_LIMIT is set to a large value, allows remote attackers to cause a…
CVE-2013-7038, published 2013-12-13. Medium severity, CVSS 6.4. EPSS: 1.8% chance of exploitation in the next 30 days. The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an…
CVE-2023-27371, published 2023-02-28. Medium severity, CVSS 5.9. EPSS: 1.3% chance of exploitation in the next 30 days. GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows…
CVE-2025-62689, published 2025-11-10. High severity, CVSS 8.7. EPSS: 0.5% chance of exploitation in the next 30 days. NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after…
CVE-2025-59777, published 2025-11-10. High severity, CVSS 8.7. EPSS: 0.5% chance of exploitation in the next 30 days. NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after…