{"id":"CVE-2025-62689","aliases":["AZL-69983","AZL-70049","DEBIAN-CVE-2025-62689","EUVD-2025-41746","GHSA-f97p-pxx9-4r46","SUSE-SU-2025:21200-1","SUSE-SU-2025:4291-1","SUSE-SU-2026:20029-1","SUSE-SU-2026:20057-1","SUSE-SU-2026:20072-1","UBUNTU-CVE-2025-62689","openSUSE-SU-2026:20016-1"],"status":"published","title":"NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The...","description":"NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00485,"percentile":0.4212,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2025-11-10T04:10:57Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"libmicrohttpd","fixed_in":["0.9.77-4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.9.76-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.77-4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.75-6","0.9.76-1","0.9.77-1","0.9.77-2","0.9.77-3","1.0.0-1","1.0.0-1.1~exp1","1.0.0-2","1.0.0-2.1","1.0.0-2.1~exp1","1.0.1-1","1.0.1-2","1.0.1-3","1.0.1-4","1.0.10-1","1.0.2-1","1.0.2-1~exp1","1.0.2-2","1.0.3-1","1.0.4-1","1.0.4-2","1.0.5-1","1.0.6-1","1.0.7-1","1.0.8-1","1.0.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-4","1.0.10-1","1.0.2-1","1.0.2-1~exp1","1.0.2-2","1.0.3-1","1.0.4-1","1.0.4-2","1.0.5-1","1.0.6-1","1.0.7-1","1.0.8-1","1.0.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-4","1.0.10-1","1.0.2-1","1.0.2-1~exp1","1.0.2-2","1.0.3-1","1.0.4-1","1.0.4-2","1.0.5-1","1.0.6-1","1.0.7-1","1.0.8-1","1.0.9-1"]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.77-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.77-150600.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.77-150600.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.77-150600.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.77-150600.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.77-150600.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.77-slfo.1.1_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.27-2","0.9.32-1","0.9.33-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.37+dfsg-1ubuntu1","0.9.42+dfsg-2","0.9.44+dfsg-1","0.9.44+dfsg-1ubuntu1","0.9.44+dfsg-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.55-1","0.9.57-1","0.9.58-1","0.9.59-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.66-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.72-2","0.9.73-4","0.9.75-1","0.9.75-3","0.9.75-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.75-6ubuntu1","1.0.0-2ubuntu1","1.0.0-2.1ubuntu1","1.0.0-2.1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-2","1.0.6-1","1.0.7-1","1.0.9-1","1.0.10-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-2","1.0.2-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libmicrohttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-160000.3.1"}]}],"bundled":2}],"products":[{"vendor":"gnu","product":"libmicrohttpd"},{"vendor":"gnu project","product":"gnu libbmicrohttpd"}],"references":[{"url":"https://www.gnu.org/software/libmicrohttpd/","tags":["Product","web","report"]},{"url":"https://git.gnunet.org/libmicrohttpd.git/commit/?id=ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b","tags":["Patch","fix","report"]},{"url":"https://jvn.jp/en/jp/JVN76719218/","tags":["Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62689","tags":["web"]},{"url":"https://jvn.jp/en/jp/JVN76719218"},{"url":"https://www.gnu.org/software/libmicrohttpd"},{"url":"https://github.com/advisories/GHSA-f97p-pxx9-4r46"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-62689","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521200-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1253177","tags":["report"]},{"url":"https://bugzilla.suse.com/1253178","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62689","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254291-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620029-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620057-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620072-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-62689","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-62689","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-62689","description":"NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.","status":"published","published":"2025-11-10T04:10:57.97Z","modified":"2025-11-14T18:01:56.011Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:32:55.19484Z"}],"euvd":[{"id":"EUVD-2025-41746","description":"NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.","status":"published","published":"2025-11-10T04:10:57Z","modified":"2025-11-14T18:01:56Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:49:16.95916Z"}],"ghsa":[{"id":"GHSA-f97p-pxx9-4r46","title":"NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The...","description":"NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.","status":"published","published":"2025-11-10T06:30:26Z","modified":"2025-11-10T06:30:31Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:04:43.026426Z"}],"nvd":[{"id":"CVE-2025-62689","description":"NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.","status":"published","published":"2025-11-10T05:15:49.087Z","modified":"2026-10-08T00:45:39.21Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:11:42.870953Z"}],"osv":[{"id":"CVE-2025-62689","description":"NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.","status":"published","published":"2025-11-10T05:15:49.087Z","modified":"2026-04-10T05:33:12.71781Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:44:51.851511Z"},{"id":"DEBIAN-CVE-2025-62689","description":"NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.","status":"published","published":"2025-11-10T05:15:49.087Z","modified":"2026-10-08T09:47:29.336435461Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"UBUNTU-CVE-2025-62689","description":"NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.","status":"published","published":"2025-11-10T05:15:00Z","modified":"2026-10-17T12:58:38.438956604Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"AZL-69983","title":"CVE-2025-62689 affecting package libmicrohttpd 0.9.76-1","description":"NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.","status":"published","published":"2025-11-10T05:15:49Z","modified":"2026-04-21T04:36:17.651654Z","updated_at":"2026-11-02T15:28:08.907584Z"},{"id":"AZL-70049","title":"CVE-2025-62689 affecting package libmicrohttpd for versions less than 0.9.77-4","description":"NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.","status":"published","published":"2025-11-10T05:15:49Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.144367Z"},{"id":"openSUSE-SU-2026:20016-1","title":"Security update for libmicrohttpd","description":"This update for libmicrohttpd fixes the following issues:\n\n- CVE-2025-62689: Fixed heap-based buffer overflow through\n  a specially crafted packet (bsc#1253178)\n- CVE-2025-59777: Fixed NULL pointer dereference through\n  a specially crafted packet (bsc#1253177)\n","status":"published","published":"2026-01-12T11:14:46Z","modified":"2026-03-23T04:54:40.903164Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2025:21200-1","title":"Security update for libmicrohttpd","description":"This update for libmicrohttpd fixes the following issues:\n\n- CVE-2025-59777: Fixed NULL pointer dereference (bsc#1253177).\n- CVE-2025-62689: Fixed heap-based buffer overflow(bsc#1253178).\n","status":"published","published":"2025-12-09T15:28:06Z","modified":"2026-03-23T04:51:15.213327Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:4291-1","title":"Security update for libmicrohttpd","description":"This update for libmicrohttpd fixes the following issues:\n\n  - CVE-2025-59777: Fixed NULL pointer dereference via specially crafted packet sent by an attacker (bsc#1253177)\n  - CVE-2025-62689: Fixed heap-based buffer overflow via specially crafted packet sent by an attacker (bsc#1253178)\n","status":"published","published":"2025-11-28T09:06:47Z","modified":"2026-02-04T03:17:05.043042Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2026:20029-1","title":"Security update for libmicrohttpd","description":"This update for libmicrohttpd fixes the following issues:\n\n- CVE-2025-62689: Fixed heap-based buffer overflow through\n  a specially crafted packet (bsc#1253178)\n- CVE-2025-59777: Fixed NULL pointer dereference through\n  a specially crafted packet (bsc#1253177)\n","status":"published","published":"2026-01-12T11:15:02Z","modified":"2026-03-23T04:52:30.050862Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20057-1","title":"Security update for libmicrohttpd","description":"This update for libmicrohttpd fixes the following issues:\n\n- CVE-2025-59777: Fixed NULL pointer dereference (bsc#1253177).\n- CVE-2025-62689: Fixed heap-based buffer overflow(bsc#1253178).\n","status":"published","published":"2026-01-02T11:07:26Z","modified":"2026-03-23T04:52:32.39064Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20072-1","title":"Security update for libmicrohttpd","description":"This update for libmicrohttpd fixes the following issues:\n\n- CVE-2025-62689: Fixed heap-based buffer overflow through\n  a specially crafted packet (bsc#1253178)\n- CVE-2025-59777: Fixed NULL pointer dereference through\n  a specially crafted packet (bsc#1253177)\n","status":"published","published":"2026-01-12T11:15:02Z","modified":"2026-03-23T04:52:33.310518Z","updated_at":"2026-11-02T15:54:01.610851Z"}]}}