Back Linuxsecurity

openSUSE Leap 16.0 Critical Buffer Overflow in libmicrohttpd CVE-2025

Linuxsecurity •LinuxSecurity Advisories • January 13, 2026

This update for libmicrohttpd fixes the following issues: - CVE-2025-62689: Fixed heap-based buffer overflow through a specially crafted packet (bsc#1253178) - CVE-2025-59777: Fixed NULL pointer dereference through a specially crafted packet (bsc#1253177) Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 16.0 zypper in -t patch openSUSE-Leap-16.0-130=1

- openSUSE Leap 16.0: libmicrohttpd-devel-1.0.1-160000.3.1 libmicrohttpd12-1.0.1-160000.3.1

- openSUSE Leap 16.0:

libmicrohttpd-devel-1.0.1-160000.3.1

libmicrohttpd12-1.0.1-160000.3.1

* bsc#1253177 * bsc#1253178 References: * *

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Buffer Overflow and NULL Pointer Vulnerabilities in libmicrohttpd The openSUSE Leap 16.0 and SUSE Linux Micro 6.0 have released updates addressing critical vulnerabilities in libmicrohttpd. These include a heap-based buffer overflow (CVE-2025-62689) and a NULL pointer dereference (CVE-2025-59777), both of which can be exploited through specially crafted packets. Users are advised to apply the patches using recommended installation methods. 2 sources 41

Extracted Entities

CVEs (2)

CVE-2025-59777 CVE-2025-62689

Platforms (2)

Libmicrohttpd OpenSUSE Leap 16.0