Dejan Alvadzijevic

**Name of the Vulnerable Software and Affected Versions** GNU libmicrohttpd versions prior to 0.9.76 **Description** The issue is related to the improper parsing of a multipart/form-data boundary in the MHD create post processor() method. This can be exploited by an attacker to send a malicious HTTP POST packet, potentially resulting in an out-of-bounds read and a crash in the find boundary() function. The exploitation of this issue may allow a remote attacker to cause a denial of service. **Recommendations** For GNU libmicrohttpd versions prior to 0.9.76, update to version 0.9.76 or later to resolve the issue. As a temporary workaround, consider restricting access to the postprocessor.c module or disabling the MHD create post processor() function until a patch is available. Avoid using the `boundary` field in multipart/form-data requests until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Crow versions prior to 1.0+4 **Description** The issue is a heap-based buffer overflow that occurs via the function `qs parse` in `query string.h`. This allows attackers to remotely execute arbitrary code in the context of the vulnerable service. **Recommendations** For Crow versions prior to 1.0+4, update to version 1.0+4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `qs parse` function in `query string.h` to minimize the risk of exploitation.