Every CVESearch/Get API key

CVE-2013-7038

The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to...

6.4 MediumFix available

CVE-2013-7038 is a medium vulnerability (CVSS 6.4) in Gnu Libmicrohttpd, published December 13, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.82%, the 79th percentile. Fixed in libmicrohttpd 0.9.32-1.

What does this mean?
Severity
6.4 MediumCVSS 2.0, NVD
Exploit chance
1.82%EPSS, 79th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0.9.32-1libmicrohttpd +7 more

Description

The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read.

Exploit likelihood

1.82%Up 0.5 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libmicrohttpd
Debian:12
before 0.9.32-1
0.9.32-1
libmicrohttpd
Debian:13
before 0.9.32-1
0.9.32-1
libmicrohttpd
Debian:14
before 0.9.32-1
0.9.32-1
libmicrohttpd
Mageia:3
From an advisory covering 2 CVEs
before 0.9.33-1.mga3
0.9.33-1.mga3
libmicrohttpd
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
From an advisory covering 2 CVEs
before 0.9.30-5.1
0.9.30-5.1
libmicrohttpd
SUSE:Linux Enterprise Software Development Kit 12 SP2
From an advisory covering 2 CVEs
before 0.9.30-5.1
0.9.30-5.1
libmicrohttpd
SUSE:Linux Enterprise Server 12 SP2
From an advisory covering 2 CVEs
before 0.9.30-5.1
0.9.30-5.1
libmicrohttpd
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 2 CVEs
before 0.9.30-5.1
0.9.30-5.1

What each source reports

NVD Score used6.4

The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read.

Record
CVE-2013-7038
CVSS 2.0
6.4 MediumAV:N/AC:L/Au:N/C:P/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE ListNo score

The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read.

Record
CVE-2013-7038
Updated
2026-11-02
EUVDEUVD-2013-6838No score

The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read.

Record
EUVD-2013-6838
Updated
2026-11-03
GitHub AdvisoriesGHSA-q6qf-jwgr-5477No score

The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to...

The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read.

Record
GHSA-q6qf-jwgr-5477
Weakness
CWE-119
Updated
2026-11-02
OSVNo score

The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read.

Record
CVE-2013-7038
Updated
2026-11-02
OSVDEBIAN-CVE-2013-7038No score

The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read.

Record
DEBIAN-CVE-2013-7038
Updated
2026-11-02
Show 4 moreShow less
OSVMGASA-2014-0030No score

Updated libmicrohttpd package fixes security vulnerabilities

The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read (CVE-2013-7038).

Stack-based buffer overflow in the MHD_digest_auth_check function in libmicrohttpd before 0.9.32, when MHD_OPTION_CONNECTION_MEMORY_LIMIT is set to a large value, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long URI in an authentication header (CVE-2013-7039).

Record
MGASA-2014-0030
Updated
2026-11-02
OSVopenSUSE-SU-2024:10956-1No score

libmicrohttpd-devel-0.9.73-1.3 on GA media

These are all security issues fixed in the libmicrohttpd-devel-0.9.73-1.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10956-1
Updated
2026-11-02
OSVSUSE-SU-2017:1576-1No score

Security update for libmicrohttpd

This update for libmicrohttpd fixes the following issues:

  • CVE-2013-7038: The MHD_http_unescape function in libmicrohttpd might have allowed remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read. (bsc#854443)

  • CVE-2013-7039: Stack-based buffer overflow in the MHD_digest_auth_check function in libmicrohttpd, when MHD_OPTION_CONNECTION_MEMORY_LIMIT is set to a large value, allowed remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long URI in an authentication header. (bsc#854443)

  • Fixed various bugs found during a 2017 audit, which are more hardening measures and not security issues. (bsc#1041216)

Record
SUSE-SU-2017:1576-1
Updated
2026-11-02
OSVUBUNTU-CVE-2013-7038No score

The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read.

Record
UBUNTU-CVE-2013-7038
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 14 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open