NULL pointer dereference in libmicrohttpd - CVE-2025-62689

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU118834

NULL pointer dereference in libmicrohttpd - CVE-2025-62689

Published: November 28, 2025


Vulnerability identifier: #VU118834
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-62689
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can send a specially crafted HTTP request to the application and perform a denial of service (DoS) attack.


Affected software

libmicrohttpd
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Micro
Basesystem Module
Desktop Applications Module
openSUSE Leap
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
Anolis OS
Fedora
libmicrohttpd12
libmicrohttpd-devel
libmicrohttpd-debugsource
libmicrohttpd12-debuginfo
libmicrohttpd
libmicrohttpd-doc

How to mitigate CVE-2025-62689

Install update from vendor's repository.

libmicrohttpd12 - addressed in versions 0.9.77-150600.3.3.1, 1.0.1-160000.3.1
libmicrohttpd-devel - addressed in versions 0.9.77-150600.3.3.1, 1.0.1-160000.3.1
libmicrohttpd-debugsource - addressed in versions 0.9.77-150600.3.3.1, 1.0.1-160000.3.1
libmicrohttpd12-debuginfo - addressed in versions 0.9.77-150600.3.3.1, 1.0.1-160000.3.1
libmicrohttpd - update to 1.0.0-2
libmicrohttpd-devel - update to 1.0.0-2
libmicrohttpd-doc - update to 1.0.0-2
libmicrohttpd - addressed in versions 1.0.3-1.fc42, 1.0.3-1.fc43, 1.0.3-1.fc44

External References

Related Security Bulletins