CVE-2023-27371: gnu libmicrohttpd Out-of-bounds Read
Vulnerability summary
CVE-2023-27371 is a medium (CVSS 5.9) Out-of-bounds Read vulnerability in gnu libmicrohttpd. EPSS estimates a 1.25% chance of exploitation in the next 30 days, higher than 68.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 28-02-2023PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · Red hatEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.25%
Chance of exploitation in the next 30 days
Percentile
69%
Versus all other CVEs
30-day change
0.00 pp
From 1.25% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundCves
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Suse10 products
- libmicrohttpd&distro=SUSE Linux Enterprise Micro 5.1< 0.9.57-150000.3.3.1
- libmicrohttpd&distro=SUSE Linux Enterprise Micro 5.2< 0.9.57-150000.3.3.1
- libmicrohttpd&distro=SUSE Linux Enterprise Micro 5.3< 0.9.57-150000.3.3.1
- libmicrohttpd&distro=SUSE Linux Enterprise Micro 5.4< 0.9.57-150000.3.3.1
- libmicrohttpd&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4< 0.9.57-150000.3.3.1
Redhat5 products
- libmicrohttpd< 1:0.9.72-5.el9 | < 1:0.9.59-3.el8 | < 1:0.9.59-2.el8_8.1 | < 1:0.9.59-2.el8_6.1
- libmicrohttpd-debuginfo< 1:0.9.72-5.el9 | < 1:0.9.59-3.el8 | < 1:0.9.59-2.el8_8.1 | < 1:0.9.59-2.el8_6.1
- libmicrohttpd-debugsource< 1:0.9.72-5.el9 | < 1:0.9.59-3.el8 | < 1:0.9.59-2.el8_8.1 | < 1:0.9.59-2.el8_6.1
- libmicrohttpd-devel< 1:0.9.72-5.el9 | < 1:0.9.59-3.el8 | < 1:0.9.59-2.el8_8.1 | < 1:0.9.59-2.el8_6.1
- libmicrohttpd-doc< 1:0.9.72-5.el9 | < 1:0.9.59-3.el8 | < 1:0.9.59-2.el8_8.1 | < 1:0.9.59-2.el8_6.1
Opensuse2 products
- libmicrohttpd&distro=openSUSE Leap 15.4< 0.9.57-150000.3.3.1
- libmicrohttpd&distro=openSUSE Leap Micro 5.3< 0.9.57-150000.3.3.1
Debian1 product
- libmicrohttpd< 0.9.62-1+deb10u1 | < 0.9.75-6
Gnu1 product
- libmicrohttpd< 0.9.76
Ubuntu1 product
- libmicrohttpdAll versions (No fix recorded)
6 vendors · 20 products
