CVE-2023-27371

What it actually does

Out-of-bounds read in find_boundary() triggered by null bytes embedded in a multipart/form-data boundary string during MHD_create_post_processor() parsing, resulting in a crash under specific heap conditions.

Why it matters to the business

Remote attackers can cause repeated service crashes leading to denial of service and loss of availability for any application relying on the affected library version.

How an attack unfolds

An attacker identifies a service using a vulnerable version of GNU libmicrohttpd, crafts an HTTP POST request containing one or more null bytes inside the multipart/form-data boundary field, and sends it to trigger the parsing flaw and crash the process.

How to fix it

Upgrade GNU libmicrohttpd to version 0.9.76 or later. Rebuild and redeploy all dependent applications after the upgrade. Validate that no custom boundary handling code bypasses the library fix.

How to confirm the fix worked

Confirm the installed library version is 0.9.76 or newer. Test exposure by replaying a crafted POST containing null bytes in the boundary field and verify the process no longer crashes.

Typical attack path

1. Scan for or identify hosts exposing services built with vulnerable GNU libmicrohttpd
2. Craft a malicious multipart/form-data POST request embedding null bytes in the boundary parameter
3. Send the request to the target endpoint
4. Observe process crash or service unavailability due to out-of-bounds read in find_boundary()

How to detect it

Review web server and application logs for crashes or segmentation faults coinciding with POST requests to endpoints that accept multipart/form-data. Search for boundary strings containing embedded null characters in request logs or packet captures.

What your security team should do

• Immediately inventory all deployments using GNU libmicrohttpd and prioritize upgrade to 0.9.76
• Add version checks and dependency scanning to CI/CD pipelines to prevent reintroduction of vulnerable versions
• Monitor application logs and process health for unexpected crashes on POST endpoints handling multipart data
• Consider temporary WAF rules to block or sanitize requests with unusual boundary characters if patching is delayed