hebi

3 exploits Active since Aug 2022
CVE-2022-38667 WRITEUP CRITICAL WRITEUP
Crow < 1.0+4 - Use-After-Free via HTTP Pipelining
HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used. The HTTP parser supports HTTP pipelining, but the asynchronous Connection layer is unaware of HTTP pipelining. Specifically, the Connection layer is unaware that it has begun processing a later request before it has finished processing an earlier request.
CVSS 9.8
CVE-2022-38668 WRITEUP HIGH WRITEUP
Crow through 1.0+4 - Uninitialized Memory Exposure via Static File Request
HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data from stack memory when fulfilling a request for a static file smaller than 16 KB.
CVSS 7.5
CVE-2023-27371 WRITEUP MEDIUM WRITEUP
GNU libmicrohttpd < 0.9.76 - Denial of Service via Malicious Multipart Form-Data Boundary
GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.
CVSS 5.9