CVE-2025-62689: GNU Libmicrohttpd DoS Vulnerability

CVE-2025-62689 Overview

CVE-2025-62689 is a NULL pointer dereference vulnerability in GNU libmicrohttpd version 1.0.2 and earlier. GNU libmicrohttpd is a small C library that embeds HTTP server functionality into applications. A remote attacker can send a specially crafted HTTP packet to trigger the dereference and cause a denial-of-service (DoS) condition in the host process. The flaw was corrected in commit ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b on the master branch of the libmicrohttpd Git repository, after the v1.0.2 release tag. The vulnerability is classified under [CWE-122] and is exploitable over the network without authentication or user interaction.

Critical Impact
Remote unauthenticated attackers can crash any service that embeds vulnerable libmicrohttpd versions by sending a single malformed HTTP request.

Affected Products

GNU libmicrohttpd version 1.0.2
GNU libmicrohttpd versions prior to 1.0.2
Applications and services that embed vulnerable libmicrohttpd builds as their HTTP server component

Discovery Timeline

2025-11-10 - CVE-2025-62689 published to NVD
2025-11-14 - Last updated in NVD database

Technical Details for CVE-2025-62689

Vulnerability Analysis

The vulnerability resides in the HTTP request handling logic of GNU libmicrohttpd. When the library processes a specially crafted packet, an internal pointer is referenced before it has been validated against NULL. The resulting dereference forces the embedding process to terminate, taking down the HTTP service exposed by the application.

Because libmicrohttpd is commonly compiled directly into long-running daemons, IoT firmware, and microservices, a process crash translates into a full availability loss for the affected component. The attack requires only network reachability to the listening HTTP port. No credentials, prior session state, or user interaction are needed to trigger the condition.

The upstream maintainers addressed the issue in commit ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b. The fix adds the missing pointer validation in the affected code path before the value is used.

Root Cause

The root cause is a missing NULL-check on a pointer that the library assumes is always populated after parsing inbound request data. When a malformed or unexpected packet structure leaves the pointer uninitialized or unset, subsequent code dereferences it directly and the process faults.

Attack Vector

An attacker reaches the vulnerable code path by sending a crafted HTTP packet to any TCP port served by an application linked against vulnerable libmicrohttpd. The attack vector is network-based, requires no privileges, and produces an immediate denial-of-service outcome. Repeated requests prevent the service from being restored if automatic restart is not configured.

No public exploit code or proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing. Technical detail on the trigger condition is referenced in the JVN Vulnerability Report and the upstream GNUnet Commit Update.

Detection Methods for CVE-2025-62689

Indicators of Compromise

Unexpected termination or repeated restarts of processes that embed libmicrohttpd, often visible in systemd journal or crash logs.
Core dumps from HTTP-serving binaries showing a faulting instruction inside libmicrohttpd request-parsing functions.
Inbound HTTP requests with malformed headers or truncated bodies immediately preceding service crashes in access logs.
Sudden loss of availability on services running known versions of libmicrohttpd 1.0.2 or earlier without a corresponding administrative action.

Detection Strategies

Inventory all hosts and container images for binaries dynamically or statically linked against libmicrohttpd at version 1.0.2 or earlier using software composition analysis.
Correlate process crash events with preceding inbound HTTP traffic to identify trigger packets.
Apply network IDS rules that flag malformed HTTP request structures targeted at endpoints known to use libmicrohttpd.

Monitoring Recommendations

Forward process exit, segfault, and coredump events from Linux endpoints into a centralized analytics platform for correlation.
Track HTTP 5xx spikes and connection resets from services backed by libmicrohttpd to detect crash-loop conditions.
Monitor for repeated short-lived TCP connections from a single source to small-footprint HTTP services typical of libmicrohttpd deployments.

How to Mitigate CVE-2025-62689

Immediate Actions Required

Identify every application and appliance embedding GNU libmicrohttpd 1.0.2 or earlier and prioritize internet-exposed instances.
Rebuild affected applications against a libmicrohttpd build that includes commit ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b.
Restrict network exposure of vulnerable HTTP endpoints to trusted sources until patched binaries are deployed.
Enable automatic process supervision so that crashed services are restarted to limit DoS duration.

Patch Information

The upstream fix is available in the libmicrohttpd Git repository at commit ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b, applied to the master branch after the v1.0.2 tag. Downstream consumers should rebuild from a master snapshot that includes this commit or apply the equivalent backport from their Linux distribution once published. Refer to the GNUnet Commit Update and the GNU Project Documentation for build guidance.

Workarounds

Place vulnerable HTTP endpoints behind a reverse proxy or web application firewall that validates request structure before forwarding traffic.
Apply network-level access control to limit inbound HTTP traffic to known clients while patches are being prepared.
Configure service managers such as systemd with Restart=always to reduce the impact of crash-based DoS attempts.

bash

# Configuration example: enforce automatic restart for a service embedding libmicrohttpd
# /etc/systemd/system/my-mhd-service.service
[Service]
ExecStart=/usr/local/bin/my-mhd-service
Restart=always
RestartSec=2s