CVE-2025-62689 Null dereference in GNU libbmicrohttpd

High 8.7 Published 10 Nov 2025 Updated 14 Nov 2025

A specially crafted packet can cause a denial-of-service condition in the GNU libmicrohttpd library via a null pointer dereference.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-62689?

CVE-2025-62689 is a high-severity vulnerability in GNU libbmicrohttpd, published on 10 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.

Weakness: CWE-122

Which versions are affected by CVE-2025-62689?

It affects 1 product.

Products include Gnu Libmicrohttpd.

How do I fix CVE-2025-62689?

Apply the vendor's patch.

Is CVE-2025-62689 being exploited?

There is no known exploitation of CVE-2025-62689 in the wild and no public exploit code.

Sources

Also known as AZL-69983, AZL-70049, DEBIAN-CVE-2025-62689, GHSA-f97p-pxx9-4r46, MINI-8qvp-wr22-wjwf, UBUNTU-CVE-2025-62689.