CVE catalog

CVE-2025-59777

libmicrohttpd: CVE-2025-59777

[CVE catalog]

Severity
High · CVSS 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Source
[NVD] · [CVE record]
EPSS
0.48% · Oct 25, 2026

NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibmicrohttpdsid1.0.10-1vulnerable
Debianlibmicrohttpdforky1.0.10-1vulnerable
Debianlibmicrohttpdtrixie1.0.1-4vulnerable
Debianlibmicrohttpdbookworm0.9.75-6vulnerable
CpelibmicrohttpdNot reported1.0.3fixed
Opensuselibmicrohttpdleap 16.01.0.1-160000.3.1fixed
Suselibmicrohttpdlinux micro 6.21.0.1-160000.3.1fixed
Suselibmicrohttpdlinux micro 6.10.9.77-slfo.1.1_2.1fixed
Suselibmicrohttpdlinux enterprise server 16.01.0.1-160000.3.1fixed
Suselibmicrohttpdlinux enterprise server for sap applications 16.01.0.1-160000.3.1fixed
Suselibmicrohttpdlinux micro 6.00.9.77-2.1fixed
Suselibmicrohttpdlinux enterprise module for basesystem 15 sp60.9.77-150600.3.3.1fixed
Suselibmicrohttpdlinux enterprise module for basesystem 15 sp70.9.77-150600.3.3.1fixed
Suselibmicrohttpdlinux enterprise module for desktop applications 15 sp60.9.77-150600.3.3.1fixed
Suselibmicrohttpdlinux enterprise module for desktop applications 15 sp70.9.77-150600.3.3.1fixed
Opensuselibmicrohttpdleap 15.60.9.77-150600.3.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibmicrohttpdsourcesid(unfixed)unimportantNot reportedNot reported
Debianlibmicrohttpdsourceforky(unfixed)unimportantNot reportedNot reported
Debianlibmicrohttpdsourcetrixie(unfixed)unimportantNot reportedNot reported
Debianlibmicrohttpdsourcebookworm(unfixed)unimportantNot reportedNot reported
CpelibmicrohttpdcpeNot reported1.0.3Not reportedNVD-CVE-2025-59777Not reported
Opensuselibmicrohttpdrpmleap 16.01.0.1-160000.3.1Not reportedOPENSUSE-SU-2026:20016-1Not reported
Suselibmicrohttpdrpmlinux micro 6.21.0.1-160000.3.1Not reportedSUSE-SU-2026:20072-1Not reported
Suselibmicrohttpdrpmlinux micro 6.10.9.77-slfo.1.1_2.1Not reportedSUSE-SU-2026:20057-1Not reported
Suselibmicrohttpdrpmlinux enterprise server 16.01.0.1-160000.3.1Not reportedSUSE-SU-2026:20029-1Not reported
Suselibmicrohttpdrpmlinux enterprise server for sap applications 16.01.0.1-160000.3.1Not reportedSUSE-SU-2026:20029-1Not reported
Suselibmicrohttpdrpmlinux micro 6.00.9.77-2.1Not reportedSUSE-SU-2025:21200-1Not reported
Suselibmicrohttpdrpmlinux enterprise module for basesystem 15 sp60.9.77-150600.3.3.1Not reportedSUSE-SU-2025:4291-1Not reported
Suselibmicrohttpdrpmlinux enterprise module for basesystem 15 sp70.9.77-150600.3.3.1Not reportedSUSE-SU-2025:4291-1Not reported
Suselibmicrohttpdrpmlinux enterprise module for desktop applications 15 sp60.9.77-150600.3.3.1Not reportedSUSE-SU-2025:4291-1Not reported
Suselibmicrohttpdrpmlinux enterprise module for desktop applications 15 sp70.9.77-150600.3.3.1Not reportedSUSE-SU-2025:4291-1Not reported
Opensuselibmicrohttpdrpmleap 15.60.9.77-150600.3.3.1Not reportedSUSE-SU-2025:4291-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libmicrohttpd12]Affected

    Source package: [libmicrohttpd]

    Details (2)

    • 0.9.75-6 · amd64 · bookworm

      Affected

      dsa · libmicrohttpd · debian · bookworm; dsa · libmicrohttpd · debian · 12

    • 0.9.75-6 · arm64 · bookworm

      Affected

      dsa · libmicrohttpd · debian · bookworm; dsa · libmicrohttpd · debian · 12

  • [libmicrohttpd-dev]Affected

    Source package: [libmicrohttpd]

    Details (2)

    • 0.9.75-6 · amd64 · bookworm

      Affected

      dsa · libmicrohttpd · debian · bookworm; dsa · libmicrohttpd · debian · 12

    • 0.9.75-6 · arm64 · bookworm

      Affected

      dsa · libmicrohttpd · debian · bookworm; dsa · libmicrohttpd · debian · 12

[Debian 13 (Trixie)]

  • [libmicrohttpd12t64]Affected

    Source package: [libmicrohttpd]

    Details (2)

    • 1.0.1-4 · amd64 · trixie

      Affected

      dsa · libmicrohttpd · debian · 13

    • 1.0.1-4 · arm64 · trixie

      Affected

      dsa · libmicrohttpd · debian · 13

  • [libmicrohttpd-dev]Affected

    Source package: [libmicrohttpd]

    Details (2)

    • 1.0.1-4 · amd64 · trixie

      Affected

      dsa · libmicrohttpd · debian · 13

    • 1.0.1-4 · arm64 · trixie

      Affected

      dsa · libmicrohttpd · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]