CVE-2023-27371

Name of the Vulnerable Software and Affected Versions GNU libmicrohttpd versions prior to 0.9.76

Description The issue is related to the improper parsing of a multipart/form-data boundary in the MHD create post processor() method. This can be exploited by an attacker to send a malicious HTTP POST packet, potentially resulting in an out-of-bounds read and a crash in the find boundary() function. The exploitation of this issue may allow a remote attacker to cause a denial of service.

Recommendations For GNU libmicrohttpd versions prior to 0.9.76, update to version 0.9.76 or later to resolve the issue. As a temporary workaround, consider restricting access to the postprocessor.c module or disabling the MHD create post processor() function until a patch is available. Avoid using the boundary field in multipart/form-data requests until the issue is resolved.