CVE-2025-59777 Null dereference in GNU libbmicrohttpd

High 8.7 Published 10 Nov 2025 Updated 10 Nov 2025

A specially crafted packet can cause a denial-of-service condition in the GNU libmicrohttpd library via a null pointer dereference.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-59777?

CVE-2025-59777 is a high-severity vulnerability in GNU libbmicrohttpd, published on 10 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.

Weakness: CWE-476

Which versions are affected by CVE-2025-59777?

It affects 1 product.

Products include Gnu Libmicrohttpd.

How do I fix CVE-2025-59777?

Apply the vendor's patch.

Is CVE-2025-59777 being exploited?

There is no known exploitation of CVE-2025-59777 in the wild and no public exploit code.

Sources

Also known as AZL-69980, AZL-70046, DEBIAN-CVE-2025-59777, GHSA-f6rc-8xc8-gmfm, MINI-v52h-c3r2-rgx5, UBUNTU-CVE-2025-59777.