Every CVE Search/ Get API key

CVE-2023-27371

GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of...

5.9 MediumFix available

GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.25%Up 0.3 points since Mar 1, 2023
90%50%10%1%

What each source reports

CVE List Score used 5.9

GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.

Record
CVE-2023-27371
CVSS 3.1
5.9 MediumCVSS:3.1/AC:H/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N
Updated
2026-11-02
EUVDEUVD-2023-31147 5.9

GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.

Record
EUVD-2023-31147
CVSS 3.1
5.9 MediumCVSS:3.1/AC:H/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-x2hm-ghg4-c67m 7.5

GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of...

GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.

Record
GHSA-x2hm-ghg4-c67m
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
NVD 5.9

GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.

Record
CVE-2023-27371
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVAZL-25347 5.9

CVE-2023-27371 affecting package libmicrohttpd for versions less than 0.9.76-1

GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.

Record
AZL-25347
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 5.9

GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.

Record
CVE-2023-27371
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 16 moreShow less
OSVDEBIAN-CVE-2023-27371 5.9

GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.

Record
DEBIAN-CVE-2023-27371
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2023-1171 7.5

libmicrohttpd security update

Development files for libmicrohttpd

Security Fix(es):

GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.(CVE-2023-27371)

Record
OESA-2023-1171
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2023:6566 5.9

Red Hat Security Advisory: libmicrohttpd security update

Record
RHSA-2023:6566
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2023:7090 5.9

Red Hat Security Advisory: libmicrohttpd security update

Record
RHSA-2023:7090
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:0584 5.9

Red Hat Security Advisory: libmicrohttpd security update

Record
RHSA-2024:0584
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:1109 5.9

Red Hat Security Advisory: libmicrohttpd security update

Record
RHSA-2024:1109
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2023:6566 5.9

Moderate: libmicrohttpd security update

GNU libmicrohttpd is a small C library that makes it easy to run an HTTP server as part of another application.

Security Fix(es):

  • libmicrohttpd: remote DoS (CVE-2023-27371)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.3 Release Notes linked from the References section.

Record
RLSA-2023:6566
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2023:7090 5.9

Moderate: libmicrohttpd security update

GNU libmicrohttpd is a small C library that makes it easy to run an HTTP server as part of another application.

Security Fix(es):

  • libmicrohttpd: remote DoS (CVE-2023-27371)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.9 Release Notes linked from the References section.

Record
RLSA-2023:7090
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-27371 5.9

GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.

Record
UBUNTU-CVE-2023-27371
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2023:6566 No score

Moderate: libmicrohttpd security update

GNU libmicrohttpd is a small C library that makes it easy to run an HTTP server as part of another application.

Security Fix(es):

  • libmicrohttpd: remote DoS (CVE-2023-27371)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2023:6566
Updated
2026-11-02
OSVALSA-2023:7090 No score

Moderate: libmicrohttpd security update

GNU libmicrohttpd is a small C library that makes it easy to run an HTTP server as part of another application.

Security Fix(es):

  • libmicrohttpd: remote DoS (CVE-2023-27371)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2023:7090
Updated
2026-11-02
OSVCLSA-2025-1760026053 No score

libmicrohttpd: Fix of CVE-2023-27371

  • CVE-2023-27371: Fix improper parsing of multipart/form-data boundary in MHD_create_post_processor() to prevent remote DoS vulnerability
Record
CLSA-2025-1760026053
Updated
2026-11-02
OSVopenSUSE-SU-2024:12739-1 No score

libmicrohttpd-devel-0.9.76-1.1 on GA media

These are all security issues fixed in the libmicrohttpd-devel-0.9.76-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12739-1
Updated
2026-11-02
OSVSUSE-SU-2023:1686-1 No score

Security update for libmicrohttpd

This update for libmicrohttpd fixes the following issues:

  • CVE-2023-27371: Fixed a parser bug that could be used to crash servers using the MHD_PostProcessor (bsc#1208745).
Record
SUSE-SU-2023:1686-1
Updated
2026-11-02
OSVSUSE-SU-2023:1686-2 No score

Security update for libmicrohttpd

This update for libmicrohttpd fixes the following issues:

  • CVE-2023-27371: Fixed a parser bug that could be used to crash servers using the MHD_PostProcessor (bsc#1208745).
Record
SUSE-SU-2023:1686-2
Updated
2026-11-02
OSVSUSE-SU-2023:1944-1 No score

Security update for libmicrohttpd

This update for libmicrohttpd fixes the following issues:

  • CVE-2023-27371: Fixed parser bug that could be used to crash servers using the MHD_PostProcessor (bsc#1208745).
Record
SUSE-SU-2023:1944-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libmicrohttpd
AlmaLinux:9
 before 1:0.9.72-5.el9
1:0.9.72-5.el9
libmicrohttpd-devel
AlmaLinux:9
 before 1:0.9.72-5.el9
1:0.9.72-5.el9
libmicrohttpd-doc
AlmaLinux:9
 before 1:0.9.72-5.el9
1:0.9.72-5.el9
libmicrohttpd
AlmaLinux:8
 before 1:0.9.59-3.el8
1:0.9.59-3.el8
libmicrohttpd-devel
AlmaLinux:8
 before 1:0.9.59-3.el8
1:0.9.59-3.el8
libmicrohttpd-doc
AlmaLinux:8
 before 1:0.9.59-3.el8
1:0.9.59-3.el8
libmicrohttpd
Azure Linux:2
 before 0.9.76-1
0.9.76-1
libmicrohttpd
TuxCare:AlmaLinux:9.2
 before 1:0.9.72-4.el9.tuxcare.els1
1:0.9.72-4.el9.tuxcare.els1
libmicrohttpd-devel
TuxCare:AlmaLinux:9.2
 before 1:0.9.72-4.el9.tuxcare.els1
1:0.9.72-4.el9.tuxcare.els1
libmicrohttpd-doc
TuxCare:AlmaLinux:9.2
 before 1:0.9.72-4.el9.tuxcare.els1
1:0.9.72-4.el9.tuxcare.els1
Show 56 moreShow less
Affected packages
PackageAffectedFixed
libmicrohttpd
Debian:12
 before 0.9.75-6
0.9.75-6
libmicrohttpd
Debian:13
 before 0.9.75-6
0.9.75-6
libmicrohttpd
Debian:14
 before 0.9.75-6
0.9.75-6
libmicrohttpd
Debian:10
 before 0.9.62-1+deb10u1, plus listed versions
0.9.62-1
0.9.62-1+deb10u1
libmicrohttpd
openEuler:20.03-LTS-SP1
 before 0.9.59-8.oe1
0.9.59-8.oe1
libmicrohttpd
openEuler:20.03-LTS-SP3
 before 0.9.59-8.oe1
0.9.59-8.oe1
libmicrohttpd
openEuler:22.03-LTS
 before 0.9.75-4.oe2203sp1
0.9.75-4.oe2203sp1
libmicrohttpd
openEuler:22.03-LTS-SP1
 before 0.9.75-4.oe2203sp1
0.9.75-4.oe2203sp1
libmicrohttpd
Red Hat:enterprise_linux:9::appstream
 before 1:0.9.72-5.el9
1:0.9.72-5.el9
libmicrohttpd-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:0.9.72-5.el9
1:0.9.72-5.el9
libmicrohttpd-debugsource
Red Hat:enterprise_linux:9::appstream
 before 1:0.9.72-5.el9
1:0.9.72-5.el9
libmicrohttpd-debuginfo
Red Hat:enterprise_linux:9::crb
 before 1:0.9.72-5.el9
1:0.9.72-5.el9
libmicrohttpd-debugsource
Red Hat:enterprise_linux:9::crb
 before 1:0.9.72-5.el9
1:0.9.72-5.el9
libmicrohttpd-devel
Red Hat:enterprise_linux:9::crb
 before 1:0.9.72-5.el9
1:0.9.72-5.el9
libmicrohttpd-doc
Red Hat:enterprise_linux:9::crb
 before 1:0.9.72-5.el9
1:0.9.72-5.el9
libmicrohttpd
Red Hat:enterprise_linux:8::baseos
 before 1:0.9.59-3.el8
1:0.9.59-3.el8
libmicrohttpd-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 1:0.9.59-3.el8
1:0.9.59-3.el8
libmicrohttpd-debugsource
Red Hat:enterprise_linux:8::baseos
 before 1:0.9.59-3.el8
1:0.9.59-3.el8
libmicrohttpd-debuginfo
Red Hat:enterprise_linux:8::crb
 before 1:0.9.59-3.el8
1:0.9.59-3.el8
libmicrohttpd-debugsource
Red Hat:enterprise_linux:8::crb
 before 1:0.9.59-3.el8
1:0.9.59-3.el8
libmicrohttpd-devel
Red Hat:enterprise_linux:8::crb
 before 1:0.9.59-3.el8
1:0.9.59-3.el8
libmicrohttpd-doc
Red Hat:enterprise_linux:8::crb
 before 1:0.9.59-3.el8
1:0.9.59-3.el8
libmicrohttpd
Red Hat:rhel_eus:8.8::baseos
 before 1:0.9.59-2.el8_8.1
1:0.9.59-2.el8_8.1
libmicrohttpd-debuginfo
Red Hat:rhel_eus:8.8::baseos
 before 1:0.9.59-2.el8_8.1
1:0.9.59-2.el8_8.1
libmicrohttpd-debugsource
Red Hat:rhel_eus:8.8::baseos
 before 1:0.9.59-2.el8_8.1
1:0.9.59-2.el8_8.1
libmicrohttpd-debuginfo
Red Hat:rhel_eus:8.8::crb
 before 1:0.9.59-2.el8_8.1
1:0.9.59-2.el8_8.1
libmicrohttpd-debugsource
Red Hat:rhel_eus:8.8::crb
 before 1:0.9.59-2.el8_8.1
1:0.9.59-2.el8_8.1
libmicrohttpd-devel
Red Hat:rhel_eus:8.8::crb
 before 1:0.9.59-2.el8_8.1
1:0.9.59-2.el8_8.1
libmicrohttpd-doc
Red Hat:rhel_eus:8.8::crb
 before 1:0.9.59-2.el8_8.1
1:0.9.59-2.el8_8.1
libmicrohttpd
Red Hat:rhel_eus:8.6::baseos
 before 1:0.9.59-2.el8_6.1
1:0.9.59-2.el8_6.1
libmicrohttpd-debuginfo
Red Hat:rhel_eus:8.6::baseos
 before 1:0.9.59-2.el8_6.1
1:0.9.59-2.el8_6.1
libmicrohttpd-debugsource
Red Hat:rhel_eus:8.6::baseos
 before 1:0.9.59-2.el8_6.1
1:0.9.59-2.el8_6.1
libmicrohttpd-debuginfo
Red Hat:rhel_eus:8.6::crb
 before 1:0.9.59-2.el8_6.1
1:0.9.59-2.el8_6.1
libmicrohttpd-debugsource
Red Hat:rhel_eus:8.6::crb
 before 1:0.9.59-2.el8_6.1
1:0.9.59-2.el8_6.1
libmicrohttpd-devel
Red Hat:rhel_eus:8.6::crb
 before 1:0.9.59-2.el8_6.1
1:0.9.59-2.el8_6.1
libmicrohttpd-doc
Red Hat:rhel_eus:8.6::crb
 before 1:0.9.59-2.el8_6.1
1:0.9.59-2.el8_6.1
libmicrohttpd
Rocky Linux:9
 before 1:0.9.72-5.el9
1:0.9.72-5.el9
libmicrohttpd
Rocky Linux:8
 before 1:0.9.59-3.el8
1:0.9.59-3.el8
libmicrohttpd
SUSE:Linux Enterprise Micro 5.3
 before 0.9.57-150000.3.3.1
0.9.57-150000.3.3.1
libmicrohttpd
SUSE:Linux Enterprise Module for Basesystem 15 SP4
 before 0.9.57-150000.3.3.1
0.9.57-150000.3.3.1
libmicrohttpd
SUSE:Linux Enterprise Module for Desktop Applications 15 SP4
 before 0.9.57-150000.3.3.1
0.9.57-150000.3.3.1
libmicrohttpd
SUSE:Linux Enterprise Real Time 15 SP3
 before 0.9.57-150000.3.3.1
0.9.57-150000.3.3.1
libmicrohttpd
SUSE:Linux Enterprise Micro 5.1
 before 0.9.57-150000.3.3.1
0.9.57-150000.3.3.1
libmicrohttpd
SUSE:Linux Enterprise Micro 5.2
 before 0.9.57-150000.3.3.1
0.9.57-150000.3.3.1
libmicrohttpd
openSUSE:Leap Micro 5.3
 before 0.9.57-150000.3.3.1
0.9.57-150000.3.3.1
libmicrohttpd
openSUSE:Leap 15.4
 before 0.9.57-150000.3.3.1
0.9.57-150000.3.3.1
libmicrohttpd
SUSE:Linux Enterprise Micro 5.4
 before 0.9.57-150000.3.3.1
0.9.57-150000.3.3.1
libmicrohttpd
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 0.9.30-6.3.1
0.9.30-6.3.1
libmicrohttpd
SUSE:Linux Enterprise Server 12 SP5
 before 0.9.30-6.3.1
0.9.30-6.3.1
libmicrohttpd
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 0.9.30-6.3.1
0.9.30-6.3.1
libmicrohttpd
Ubuntu:14.04:LTS
 All versions, plus listed versions
0.9.27-20.9.32-10.9.33-1
 None known
libmicrohttpd
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.9.37+dfsg-1ubuntu10.9.42+dfsg-20.9.44+dfsg-10.9.44+dfsg-1ubuntu10.9.44+dfsg-1ubuntu2
 None known
libmicrohttpd
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.9.55-10.9.57-10.9.58-10.9.59-1
 None known
libmicrohttpd
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.9.66-1
 None known
libmicrohttpd
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.9.72-20.9.73-40.9.75-10.9.75-30.9.75-3ubuntu1
 None known
libmicrohttpd
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.9.75-6ubuntu11.0.0-2ubuntu11.0.0-2.1ubuntu11.0.0-2.1ubuntu2
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-27371 is a medium vulnerability (CVSS 5.9) in Gnu Libmicrohttpd, published February 28, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile. Fixed in libmicrohttpd 1:0.9.72-5.el9.

References

Show 30 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open