High
libmicrohttpd — security advisory
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.
- Products
- libmicrohttpd
- Affected versions
- 0.9.27-2, 0.9.32-1, 0.9.33-1, 0.9.37+dfsg-1ubuntu1, 0.9.42+dfsg-2, 0.9.44+dfsg-1, 0.9.44+dfsg-1ubuntu1, 0.9.44+dfsg-1ubuntu2, 0.9.55-1, 0.9.57-1, 0.9.58-1, 0.9.59-1, 0.9.66-1, 0.9.72-2, 0.9.73-4, 0.9.75-1, 0.9.75-3, 0.9.75-3ubuntu1, 0.9.75-6ubuntu1, 1.0.0-2.1ubuntu1, 1.0.0-2.1ubuntu2, 1.0.0-2ubuntu1, 1.0.1-2, 1.0.10-1, 1.0.2-1, 1.0.6-1, 1.0.7-1, 1.0.9-1
- Fixed versions
- Not specified
- CVEs
- CVE-2025-62689
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 02:31 UTC · Revision 1
Source evidence
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.
osv:UBUNTU-CVE-2025-62689
libmicrohttpd
Fixed versions: Not specified
libmicrohttpd
Fixed versions: Not specified
libmicrohttpd
Fixed versions: Not specified
libmicrohttpd
Fixed versions: Not specified
libmicrohttpd
Fixed versions: Not specified
libmicrohttpd
Fixed versions: Not specified
libmicrohttpd
Fixed versions: Not specified
libmicrohttpd
Fixed versions: Not specified
libmicrohttpd
Fixed versions: Not specified
Complete source record
{
"id": "e21723779eab65824672b424d2e66dd341bacfd00681c8d1e448ae79a2f9cf66",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2025-62689",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2025-62689",
"summary": "NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.",
"evidence": "osv:UBUNTU-CVE-2025-62689",
"products": [
{
"name": {
"value": "libmicrohttpd",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.9.27-2",
"evidence": "/affected/0/versions"
},
{
"value": "0.9.32-1",
"evidence": "/affected/0/versions"
},
{
"value": "0.9.33-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "libmicrohttpd",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.9.37+dfsg-1ubuntu1",
"evidence": "/affected/1/versions"
},
{
"value": "0.9.42+dfsg-2",
"evidence": "/affected/1/versions"
},
{
"value": "0.9.44+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "0.9.44+dfsg-1ubuntu1",
"evidence": "/affected/1/versions"
},
{
"value": "0.9.44+dfsg-1ubuntu2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "libmicrohttpd",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.9.55-1",
"evidence": "/affected/2/versions"
},
{
"value": "0.9.57-1",
"evidence": "/affected/2/versions"
},
{
"value": "0.9.58-1",
"evidence": "/affected/2/versions"
},
{
"value": "0.9.59-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "libmicrohttpd",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.9.66-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "libmicrohttpd",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.9.72-2",
"evidence": "/affected/4/versions"
},
{
"value": "0.9.73-4",
"evidence": "/affected/4/versions"
},
{
"value": "0.9.75-1",
"evidence": "/affected/4/versions"
},
{
"value": "0.9.75-3",
"evidence": "/affected/4/versions"
},
{
"value": "0.9.75-3ubuntu1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "libmicrohttpd",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.9.75-6ubuntu1",
"evidence": "/affected/5/versions"
},
{
"value": "1.0.0-2ubuntu1",
"evidence": "/affected/5/versions"
},
{
"value": "1.0.0-2.1ubuntu1",
"evidence": "/affected/5/versions"
},
{
"value": "1.0.0-2.1ubuntu2",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "libmicrohttpd",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.0.1-2",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "libmicrohttpd",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.0.1-2",
"evidence": "/affected/7/versions"
},
{
"value": "1.0.6-1",
"evidence": "/affected/7/versions"
},
{
"value": "1.0.7-1",
"evidence": "/affected/7/versions"
},
{
"value": "1.0.9-1",
"evidence": "/affected/7/versions"
},
{
"value": "1.0.10-1",
"evidence": "/affected/7/versions"
}
]
},
{
"name": {
"value": "libmicrohttpd",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.0.1-2",
"evidence": "/affected/8/versions"
},
{
"value": "1.0.2-1",
"evidence": "/affected/8/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2025-62689",
"aliases": [
"UBUNTU-CVE-2025-62689"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmicrohttpd",
"purl": "pkg:deb/ubuntu/libmicrohttpd?arch=source&distro=trusty",
"ecosystem": "Ubuntu:14.04:LTS"
},
"versions": [
"0.9.27-2",
"0.9.32-1",
"0.9.33-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-62689.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmicrohttpd10",
"binary_version": "0.9.33-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmicrohttpd",
"purl": "pkg:deb/ubuntu/libmicrohttpd?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"0.9.37+dfsg-1ubuntu1",
"0.9.42+dfsg-2",
"0.9.44+dfsg-1",
"0.9.44+dfsg-1ubuntu1",
"0.9.44+dfsg-1ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-62689.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmicrohttpd10",
"binary_version": "0.9.44+dfsg-1ubuntu2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmicrohttpd",
"purl": "pkg:deb/ubuntu/libmicrohttpd?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"0.9.55-1",
"0.9.57-1",
"0.9.58-1",
"0.9.59-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-62689.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmicrohttpd12",
"binary_version": "0.9.59-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmicrohttpd",
"purl": "pkg:deb/ubuntu/libmicrohttpd?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"0.9.66-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-62689.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmicrohttpd12",
"binary_version": "0.9.66-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmicrohttpd",
"purl": "pkg:deb/ubuntu/libmicrohttpd?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"0.9.72-2",
"0.9.73-4",
"0.9.75-1",
"0.9.75-3",
"0.9.75-3ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-62689.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmicrohttpd12",
"binary_version": "0.9.75-3ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmicrohttpd",
"purl": "pkg:deb/ubuntu/libmicrohttpd?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"0.9.75-6ubuntu1",
"1.0.0-2ubuntu1",
"1.0.0-2.1ubuntu1",
"1.0.0-2.1ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-62689.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmicrohttpd12t64",
"binary_version": "1.0.0-2.1ubuntu2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmicrohttpd",
"purl": "pkg:deb/ubuntu/libmicrohttpd?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"1.0.1-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-62689.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmicrohttpd12t64",
"binary_version": "1.0.1-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmicrohttpd",
"purl": "pkg:deb/ubuntu/libmicrohttpd?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1.0.1-2",
"1.0.6-1",
"1.0.7-1",
"1.0.9-1",
"1.0.10-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-62689.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmicrohttpd12t64",
"binary_version": "1.0.10-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmicrohttpd",
"purl": "pkg:deb/ubuntu/libmicrohttpd?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1.0.1-2",
"1.0.2-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-62689.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmicrohttpd12t64",
"binary_version": "1.0.2-1"
}
]
}
}
],
"modified": "2026-10-17T12:58:38.438956604Z",
"provider": "osv",
"upstream": [
"CVE-2025-62689"
],
"references": [
"https://ubuntu.com/security/CVE-2025-62689",
"https://www.cve.org/CVERecord?id=CVE-2025-62689",
"https://git.gnunet.org/libmicrohttpd.git/commit/?id=ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b",
"https://jvn.jp/en/jp/JVN76719218/",
"https://www.gnu.org/software/libmicrohttpd/"
]
},
"related_cves": [
{
"value": "CVE-2025-62689",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/1/score"
},
"source_id": "core-osv",
"document_id": 358920,
"published_at": "2025-11-10T05:15:00+00:00"
}