Unscored severity · published Dec 13, 2013
CVE-2013-7038
The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified…
–
CVSS
1.8%
EPSS
No
On KEV
Description
The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Libmicrohttpd · Gnu
through 0.9.31; 0.9.16; 0.9.17; 0.9.18; 0.9.19; 0.9.20; +10 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-7038
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-7038
secunia.com
http://secunia.com/advisories/55903
security.gentoo.org
http://security.gentoo.org/glsa/glsa-201402-01.xml
www.openwall.com
http://www.openwall.com/lists/oss-security/2013/12/09/11
www.securityfocus.com
http://www.securityfocus.com/bid/64138
bugs.gentoo.org
https://bugs.gentoo.org/show_bug.cgi?id=493450
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1039384
More from Libmicrohttpd
9.8
CVE-2021-3466
A flaw was found in libmicrohttpd
7.5
CVE-2025-62689
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier
7.5
CVE-2025-59777
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier
5.9
CVE-2023-27371
GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor()…
–
CVE-2013-7039
Stack-based buffer overflow in the MHD_digest_auth_check function in libmicrohttpd before 0.9.32, when MHD_OPTION_CONNECTION_MEMORY_LIMIT is set to a large value, allows remote…