Vulnerability · Published Mar 25, 2021 · Assigned by redhat

CVE-2021-3466

Critical 9.8

In plain English

A critical-severity buffer overflow in libmicrohttpd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 8.7% (higher than 95% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)8.7%top 4.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A flaw was found in libmicrohttpd. A missing bounds check in the post_process_urlencoded function leads to a buffer overflow, allowing a remote attacker to write arbitrary data in an application that uses libmicrohttpd. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Only version 0.9.70 is vulnerable.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	libmicrohttpd	0.9.71-1	DEBIAN-CVE-2021-3466
Debian:13	libmicrohttpd	0.9.71-1	DEBIAN-CVE-2021-3466
Debian:14	libmicrohttpd	0.9.71-1	DEBIAN-CVE-2021-3466

Affected products (as reported)

Vendor	Product	Versions
n/a	libmicrohttpd	libmicrohttpd 0.9.70

Weakness: CWE-120

References

https://bugzilla.redhat.com/show_bug.cgi?id=1939127
FEDORA-2021-6d5578e756 vendor-advisory
FEDORA-2021-d4149ff7fb vendor-advisory
FEDORA-2021-5e10ad8c19 vendor-advisory
GLSA-202311-08 vendor-advisory