CVEvulnerability

CVE-2021-3466

9.8 CRITICAL Published 2021-03-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-03-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-120

Description

A flaw was found in libmicrohttpd. A missing bounds check in the post_process_urlencoded function leads to a buffer overflow, allowing a remote attacker to write arbitrary data in an application that uses libmicrohttpd. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Only version 0.9.70 is vulnerable.

Affected configurations

• gnu libmicrohttpd 0.9.70 • redhat enterprise linux 6.0 • redhat enterprise linux 7.0 • redhat enterprise linux 8.0 • fedoraproject fedora 32 • fedoraproject fedora 33 • fedoraproject fedora 34

Related

Weakness · CWE (1)

  • CWE-120 Buffer Copy without Checking Size of Input weakness

References