Denial of Service Vulnerability in GNU libmicrohttpd Affects Multiple Applications

CVE-2023-27371

Summary

GNU libmicrohttpd versions prior to 0.9.76 are susceptible to a Denial of Service vulnerability that arises from improper handling of multipart/form-data boundaries in the postprocessor. This flaw allows an attacker to discreetly send a malformed HTTP POST request, which includes null ('\0') bytes in the boundary field. If the request is crafted in a specific way, it can lead to an out-of-bounds read during processing, ultimately causing a crash when the find_boundary() function is executed. This vulnerability can disrupt services relying on the affected versions of libmicrohttpd.

References