Gnu · Gnu Libmicrohttpd · CVE-2023-27371
**Name of the Vulnerable Software and Affected Versions**
GNU libmicrohttpd versions prior to 0.9.76
**Description**
The issue is related to the improper parsing of a multipart/form-data boundary in the MHD create post processor() method. This can be exploited by an attacker to send a malicious HTTP POST packet, potentially resulting in an out-of-bounds read and a crash in the find boundary() function. The exploitation of this issue may allow a remote attacker to cause a denial of service.
**Recommendations**
For GNU libmicrohttpd versions prior to 0.9.76, update to version 0.9.76 or later to resolve the issue. As a temporary workaround, consider restricting access to the postprocessor.c module or disabling the MHD create post processor() function until a patch is available. Avoid using the `boundary` field in multipart/form-data requests until the issue is resolved.