Read the docs
TI-2013-05783 Aliases CVE-2013-7038GHSA-q6qf-jwgr-5477

The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote…

Priority LOW 32CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · None · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read.

Why it matters now

EPSS 0.01823 78th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:gnu:libmicrohttpd:*:*:*:*:*:*:*:*up to 0.9.31VulnerableGNU
cpe:2.3:a:gnu:libmicrohttpd:0.9.16:*:*:*:*:*:*:*0.9.16VulnerableGNU
cpe:2.3:a:gnu:libmicrohttpd:0.9.17:*:*:*:*:*:*:*0.9.17VulnerableGNU
cpe:2.3:a:gnu:libmicrohttpd:0.9.18:*:*:*:*:*:*:*0.9.18VulnerableGNU
cpe:2.3:a:gnu:libmicrohttpd:0.9.19:*:*:*:*:*:*:*0.9.19VulnerableGNU
cpe:2.3:a:gnu:libmicrohttpd:0.9.20:*:*:*:*:*:*:*0.9.20VulnerableGNU
cpe:2.3:a:gnu:libmicrohttpd:0.9.21:*:*:*:*:*:*:*0.9.21VulnerableGNU
cpe:2.3:a:gnu:libmicrohttpd:0.9.22:*:*:*:*:*:*:*0.9.22VulnerableGNU
cpe:2.3:a:gnu:libmicrohttpd:0.9.23:*:*:*:*:*:*:*0.9.23VulnerableGNU
cpe:2.3:a:gnu:libmicrohttpd:0.9.24:*:*:*:*:*:*:*0.9.24VulnerableGNU
  • cpe:2.3:a:gnu:libmicrohttpd:*:*:*:*:*:*:*:* Versions up to 0.9.31 Vulnerable ·GNU
  • cpe:2.3:a:gnu:libmicrohttpd:0.9.16:*:*:*:*:*:*:* Versions 0.9.16 Vulnerable ·GNU
  • cpe:2.3:a:gnu:libmicrohttpd:0.9.17:*:*:*:*:*:*:* Versions 0.9.17 Vulnerable ·GNU
  • cpe:2.3:a:gnu:libmicrohttpd:0.9.18:*:*:*:*:*:*:* Versions 0.9.18 Vulnerable ·GNU
  • cpe:2.3:a:gnu:libmicrohttpd:0.9.19:*:*:*:*:*:*:* Versions 0.9.19 Vulnerable ·GNU
  • cpe:2.3:a:gnu:libmicrohttpd:0.9.20:*:*:*:*:*:*:* Versions 0.9.20 Vulnerable ·GNU
  • cpe:2.3:a:gnu:libmicrohttpd:0.9.21:*:*:*:*:*:*:* Versions 0.9.21 Vulnerable ·GNU
  • cpe:2.3:a:gnu:libmicrohttpd:0.9.22:*:*:*:*:*:*:* Versions 0.9.22 Vulnerable ·GNU
  • cpe:2.3:a:gnu:libmicrohttpd:0.9.23:*:*:*:*:*:*:* Versions 0.9.23 Vulnerable ·GNU
  • cpe:2.3:a:gnu:libmicrohttpd:0.9.24:*:*:*:*:*:*:* Versions 0.9.24 Vulnerable ·GNU
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:gnu:libmicrohttpd:0.9.25:*:*:*:*:*:*:*0.9.25VulnerableGNU
cpe:2.3:a:gnu:libmicrohttpd:0.9.26:*:*:*:*:*:*:*0.9.26VulnerableGNU
cpe:2.3:a:gnu:libmicrohttpd:0.9.27:*:*:*:*:*:*:*0.9.27VulnerableGNU
cpe:2.3:a:gnu:libmicrohttpd:0.9.28:*:*:*:*:*:*:*0.9.28VulnerableGNU
cpe:2.3:a:gnu:libmicrohttpd:0.9.29:*:*:*:*:*:*:*0.9.29VulnerableGNU
cpe:2.3:a:gnu:libmicrohttpd:0.9.30:*:*:*:*:*:*:*0.9.30VulnerableGNU
  • cpe:2.3:a:gnu:libmicrohttpd:0.9.25:*:*:*:*:*:*:* Versions 0.9.25 Vulnerable ·GNU
  • cpe:2.3:a:gnu:libmicrohttpd:0.9.26:*:*:*:*:*:*:* Versions 0.9.26 Vulnerable ·GNU
  • cpe:2.3:a:gnu:libmicrohttpd:0.9.27:*:*:*:*:*:*:* Versions 0.9.27 Vulnerable ·GNU
  • cpe:2.3:a:gnu:libmicrohttpd:0.9.28:*:*:*:*:*:*:* Versions 0.9.28 Vulnerable ·GNU
  • cpe:2.3:a:gnu:libmicrohttpd:0.9.29:*:*:*:*:*:*:* Versions 0.9.29 Vulnerable ·GNU
  • cpe:2.3:a:gnu:libmicrohttpd:0.9.30:*:*:*:*:*:*:* Versions 0.9.30 Vulnerable ·GNU

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-7038
  2. 2026-10-03 Alias added: GHSA-q6qf-jwgr-5477

References

Advisory 1

Other 4

  • TI-2021-02429 Buffer overflow in libmicrohttpd CVSS 3.1CRITICAL 9.8
  • TI-2025-38881 Heap-based buffer overflow in GNU libbmicrohttpd CVSS 4.0HIGH 8.7
  • TI-2025-37229 NULL pointer dereference in GNU libbmicrohttpd CVSS 4.0HIGH 8.7
  • TI-2023-12106 GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper… CVSS 3.1MEDIUM 5.9
  • TI-2013-05784 Stack-based buffer overflow in the MHD_digest_auth_check function in libmicrohttpd before… CVSS 2.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences