What’s Vulnerable › Vulnerabilities

CVE-2025-62689

• Severity: high (CVSS 8.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-10 · updated 2026-10-08
• Weakness: CWE-122

Description

NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.

Affected products

• GNU Libmicrohttpd: before 1.0.3 — fixed in 1.0.3

How to fix

Upgrade to a fixed version: GNU Libmicrohttpd 1.0.3. Check the vendor advisory for mitigations.

References

• https://git.gnunet.org/libmicrohttpd.git/commit/?id=ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b
• https://jvn.jp/en/jp/JVN76719218/
• https://www.gnu.org/software/libmicrohttpd/

Get alerted when CVE-2025-62689 or the next vulnerability affects your stack