High severity · published Nov 10, 2025
CVE-2025-59777
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
GNU libbmicrohttpd · GNU Project
v1.0.2 and earlier (The vulnerability remains in the source code up until commit ff13abc on the master branch of the libmicrohttpd Git repository; after the v1.0.2 tag.) · source: vendor
LI
Libmicrohttpd · Gnu
before 1.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59777
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59777
Patch
https://git.gnunet.org/libmicrohttpd.git/commit/?id=ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b
Third Party Advisory
https://jvn.jp/en/jp/JVN76719218/
Product
https://www.gnu.org/software/libmicrohttpd/
More from GNU libbmicrohttpd
7.5
CVE-2025-62689
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier