CVE-2023-27371

Summary

CVE	CVE-2023-27371
State	PUBLISHED
Assigner	mitre
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-02-28 20:15:10 UTC
Updated	2026-10-14 23:17:15 UTC
Description	GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.

Primary CVSS: v3.1 5.9 MEDIUM from [email protected]

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.012530000 probability, percentile 0.688710000 (date 2026-10-14)

Problem Types: CWE-125 | n/a

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	5.9	MEDIUM	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H`
3.1	[email protected]	Secondary	5.9	MEDIUM	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H`
3.1	CNA	DECLARED	5.9	MEDIUM	`CVSS:3.1/AC:H/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N`

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Type	Vendor	Product	Version	Update	Edition	Language
Application	Gnu	Libmicrohttpd	All	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified
ADP	Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified
ADP	Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified
ADP	Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified
ADP	Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified
ADP	Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified

Reference	Source	Link	Tags
cert-portal.siemens.com/productcert/html/ssa-398330.html	0b142b55-0307-4c5a-b3c9-f314f3fb7c5e	cert-portal.siemens.com
[SECURITY] [DLA 3374-1] libmicrohttpd security update	af854a3a-2127-422b-91ae-364da2661108	lists.debian.org
CVEs/GNU Libmicrohttpd at main · 0xhebi/CVEs · GitHub	af854a3a-2127-422b-91ae-364da2661108	github.com	Exploit, Third Party Advisory
libmicrohttpd.git - GNU libmicrohttpd	af854a3a-2127-422b-91ae-364da2661108	git.gnunet.org	Patch
[libmicrohttpd] GNU libmicrohttpd 0.9.76 released	af854a3a-2127-422b-91ae-364da2661108	lists.gnu.org	Mailing List
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

161095 Oracle Enterprise Linux Security Update for libmicrohttpd (ELSA-2023-6566)
161163 Oracle Enterprise Linux Security Update for libmicrohttpd (ELSA-2023-7090)
181645 Debian Security Update for libmicrohttpd (DLA 3374-1)
182586 Debian Security Update for libmicrohttpd (CVE-2023-27371)
242291 Red Hat Update for libmicrohttpd (RHSA-2023:6566)
242460 Red Hat Update for libmicrohttpd (RHSA-2023:7090)
242791 Red Hat Update for libmicrohttpd (RHSA-2024:0584)
243039 Red Hat Update for libmicrohttpd (RHSA-2024:1109)
296108 Oracle Solaris 11.4 Support Repository Update (SRU) 66.164.1 Missing (CPUJAN2024)
355598 Amazon Linux Security Advisory for libmicrohttpd : ALAS2-2023-2135
673382 EulerOS Security Update for libmicrohttpd (EulerOS-SA-2023-3133)
673816 EulerOS Security Update for libmicrohttpd (EulerOS-SA-2024-1146)
753867 SUSE Enterprise Linux Security Update for libmicrohttpd (SUSE-SU-2023:1686-1)
753932 SUSE Enterprise Linux Security Update for libmicrohttpd (SUSE-SU-2023:1944-1)
907270 Common Base Linux Mariner (CBL-Mariner) Security Update for libmicrohttpd (25347-1)
941364 AlmaLinux Security Update for libmicrohttpd (ALSA-2023:6566)
941435 AlmaLinux Security Update for libmicrohttpd (ALSA-2023:7090)