uc-http vulnerabilities and fixes

Recent CVEs affecting uc-http, with upgrade or downgrade steps. 7 tracked.

Also searched as: uc http.

uc-http has 7 tracked vulnerabilities, 6 critical. A fixed release or vendor patch exists for 0. Most recent: 2024-02-20. Highest priority: CVE-2023-45318 (score 64/100).

CVE-2023-45318 CRITICAL 10.0 DOWNGRADE MITIGATE A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP
CVE-2023-31247 CRITICAL 9.0 DOWNGRADE DOWNGRADE A memory corruption vulnerability exists in the HTTP Server Host header parsing functionality of Weston Embedd
CVE-2023-28391 CRITICAL 9.0 DOWNGRADE DOWNGRADE A memory corruption vulnerability exists in the HTTP Server header parsing functionality of Weston Embedded uC
CVE-2023-28379 CRITICAL 9.0 DOWNGRADE DOWNGRADE A memory corruption vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-
CVE-2023-27882 CRITICAL 9.0 DOWNGRADE DOWNGRADE A heap-based buffer overflow vulnerability exists in the HTTP Server form boundary functionality of Weston Emb
CVE-2023-25181 CRITICAL 9.0 DOWNGRADE DOWNGRADE A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP
CVE-2023-24585 HIGH 7.7 DOWNGRADE DOWNGRADE An out-of-bounds write vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.

FAQ

How do I fix uc-http vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is uc-http being exploited right now?

None of the tracked uc-http CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which uc-http CVE should I patch first?

CVE-2023-45318 currently ranks highest (64/100): A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP .

RSS feed for uc-http · ← Back to latest CVEs