GNU Project vulnerabilities
We track 5 vulnerabilities in GNU Project products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on November 10, 2025.
Latest GNU Project vulnerabilities
- 8.7 High severity
GNU libbmicrohttpd: Heap-based Buffer Overflow
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker
- 8.7 High severity
GNU libbmicrohttpd: NULL Pointer Dereference
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker
- 7.8 High severity
GNU GRUB: Use After Free
There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-af
- 7.0 High severity
GNU GRUB: Out-of-bounds Write
Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one position. This can lead to a out-of-bound write further when parsing the HTTP request, writing a NU
- 8.1 High severity
GNU GRUB: Integer Underflow (Wrap or Wraparound)
Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet can lead to an integer underflow in grub_net_recv_ip4_packets() function on rsm->total_len value. Under certain circumstances the total_len value may end up wrapping around to a smal