Vulnerability · Published Nov 10, 2025 · Assigned by jpcert
CVE-2025-62689
High 7.5
In plain English
A high-severity heap buffer overflow in GNU libbmicrohttpd from GNU Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 3.0)7.5High
Exploit odds (30 days)0.5%top 58.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libmicrohttpd | no fix listed | DEBIAN-CVE-2025-62689 |
| Debian:13 | libmicrohttpd | no fix listed | DEBIAN-CVE-2025-62689 |
| Debian:14 | libmicrohttpd | no fix listed | DEBIAN-CVE-2025-62689 |
| Ubuntu:22.04:LTS | libmicrohttpd | no fix listed | UBUNTU-CVE-2025-62689 |
| Ubuntu:24.04:LTS | libmicrohttpd | no fix listed | UBUNTU-CVE-2025-62689 |
| Ubuntu:25.10 | libmicrohttpd | no fix listed | UBUNTU-CVE-2025-62689 |
| Ubuntu:26.04:LTS | libmicrohttpd | no fix listed | UBUNTU-CVE-2025-62689 |
| Ubuntu:26.10 | libmicrohttpd | no fix listed | UBUNTU-CVE-2025-62689 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GNU Project | GNU libbmicrohttpd | v1.0.2 and earlier (The vulnerability remains in the source code up until commit ff13abc on the master branch of the libmicrohttpd Git repositoryafter the v1.0.2 tag.) |
Weakness: CWE-122 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H