Skip to content
OpenAdvisories
Medium · 5.9 CVE-2023-27371 EUVD-2023-31147GHSA-x2hm-ghg4-c67m

GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the post…

Published Feb 28, 2023 · Updated Oct 14, 2026 · Assigned by mitre

Package: libmicrohttpd Package: libmicrohttpd Package: libmicrohttpd Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 libmicrohttpd 0.9.75-6 —
Debian 13 libmicrohttpd 0.9.75-6 —
Debian 12 libmicrohttpd 0.9.75-6 —
Debian 10 libmicrohttpd 0.9.62-1+deb10u1 DLA-3374-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS libmicrohttpd No fix yet —
Ubuntu 22.04 LTS libmicrohttpd No fix yet —
Ubuntu 20.04 LTS libmicrohttpd No fix yet —
Ubuntu 18.04 LTS libmicrohttpd No fix yet —
Ubuntu 16.04 LTS libmicrohttpd No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 14.04 LTS libmicrohttpd No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 libmicrohttpd +2 1:0.9.72-5.el9 RHSA-2023:6566
RHEL 8 libmicrohttpd +2 1:0.9.59-3.el8 RHSA-2023:7090
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 8.8 EUS libmicrohttpd +2 1:0.9.59-2.el8_8.1 RHSA-2024:0584
RHEL 8.6 EUS libmicrohttpd +2 1:0.9.59-2.el8_6.1 RHSA-2024:1109

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 libmicrohttpd +2 1:0.9.72-5.el9 ALSA-2023:6566
AlmaLinux 8 libmicrohttpd +2 1:0.9.59-3.el8 ALSA-2023:7090

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 libmicrohttpd 1:0.9.72-5.el9 RLSA-2023:6566
Rocky Linux 8 libmicrohttpd 1:0.9.59-3.el8 RLSA-2023:7090

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 libmicrohttpd 0.9.57-150000.3.3.1 SUSE-SU-2023:1686-1
SLES 12 SP5 libmicrohttpd 0.9.30-6.3.1 SUSE-SU-2023:1944-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP5 libmicrohttpd 0.9.30-6.3.1 SUSE-SU-2023:1944-1
SLE Real Time 15 SP3 libmicrohttpd 0.9.57-150000.3.3.1 SUSE-SU-2023:1686-1
SLE Micro 5.4 libmicrohttpd 0.9.57-150000.3.3.1 SUSE-SU-2023:1686-2
SLE Micro 5.3 libmicrohttpd 0.9.57-150000.3.3.1 SUSE-SU-2023:1686-1
SLE Micro 5.2 libmicrohttpd 0.9.57-150000.3.3.1 SUSE-SU-2023:1686-1
SLE Micro 5.1 libmicrohttpd 0.9.57-150000.3.3.1 SUSE-SU-2023:1686-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 15.4 libmicrohttpd 0.9.57-150000.3.3.1 SUSE-SU-2023:1686-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
openSUSE Leap Micro 5.3 libmicrohttpd 0.9.57-150000.3.3.1 SUSE-SU-2023:1686-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 libmicrohttpd +2 1:0.9.73-1.amzn2023.0.4 ALAS2023-2025-1133
Amazon Linux 2 libmicrohttpd +2 0.9.33-2.amzn2.0.3 ALAS2-2023-2135

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 2 (CBL-Mariner) libmicrohttpd 0.9.76-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 libmicrohttpd +2 1:0.9.72-5.el9 ELSA-2023-6566
Oracle Linux 8 libmicrohttpd +2 1:0.9.59-3.el8 ELSA-2023-7090

Advisories 20

References