CVE-2019-12412

What it actually does

Null pointer dereference in the multipart parser of libapreq2 versions 2.07 to 2.13 causes the hosting process to crash.

Why it matters to the business

Remote attackers can trigger repeated crashes to make dependent web services unavailable, leading to downtime and degraded operations.

How an attack unfolds

An attacker sends a crafted multipart HTTP request that exercises the flawed parser path, dereferencing a null pointer and terminating the process.

How to fix it

Upgrade libapreq2 to a patched release once available; in the interim apply strict request validation, size limits on multipart bodies, and web application firewall rules to drop suspicious payloads.

How to confirm the fix worked

Reproduce the crash with a minimal malformed multipart request in an isolated test environment, then confirm absence of the crash after applying updates or mitigations.

Typical attack path

1. Identify a service using vulnerable libapreq2 for multipart request handling
2. Craft and transmit a malformed multipart request designed to hit the null dereference
3. Observe process crash resulting in denial of service

How to detect it

Review application and system logs for unexpected process terminations or segmentation faults immediately following receipt of multipart requests.

What your security team should do

• Prioritize upgrade of libapreq2 once fixed versions are released
• Deploy input sanitization and rate limiting on multipart endpoints
• Enable process monitoring and automatic restarts with alerting on crashes