GHSA-xjp8-4qqv-5x4x: LibVNCServer httpd proxy NULL Pointer Dereference

Q: Which deployments are exposed to this denial-of-service issue?

LibVNCServer versions 0.9.15 and earlier are affected when both the HTTP server (httpd) and proxy features are enabled. Deployments without those features enabled are not identified as affected by the provided information.

Q: What does an attacker need to do to trigger the crash?

A remote attacker can send specially crafted HTTP requests to the HTTP proxy handlers. No privileges or user interaction are required, but exploitation depends on the vulnerable HTTP and proxy functionality being enabled.

Q: What is the available remediation?

Update to a version containing the fix from commit dc78dee. The fix addresses missing validation of strchr() return values in the CONNECT and GET proxy handling paths.

Q: What can be done if updating is not immediately possible?

Disable the HTTP server or proxy features where operationally feasible, since the issue is described as exploitable only when both are enabled. Restricting remote access to the affected HTTP service can also reduce exposure, though the provided data does not describe a complete workaround.

Published Mar 24, 2026

Updated

LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.

Affected Software

1 affected component

LibVNCServer LibVNCServer<=0.9.15

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade LibVNCServer to a version that resolves this vulnerability.
Patch dc78dee

Event History

Mar 24, 2026

CVE Published

via OSV·05:31 PM

Data Sourced

via OSV·05:31 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

LibVNCServer versions 0.9.15 and earlier are affected when both the HTTP server (httpd) and proxy features are enabled. Deployments without those features enabled are not identified as affected by the provided information.

What does an attacker need to do to trigger the crash?

A remote attacker can send specially crafted HTTP requests to the HTTP proxy handlers. No privileges or user interaction are required, but exploitation depends on the vulnerable HTTP and proxy functionality being enabled.

What is the available remediation?

Update to a version containing the fix from commit dc78dee. The fix addresses missing validation of strchr() return values in the CONNECT and GET proxy handling paths.

What can be done if updating is not immediately possible?

Disable the HTTP server or proxy features where operationally feasible, since the issue is described as exploitable only when both are enabled. Restricting remote access to the affected HTTP service can also reduce exposure, though the provided data does not describe a complete workaround.

GHSA-xjp8-4qqv-5x4x: LibVNCServer httpd proxy NULL Pointer Dereference

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What does an attacker need to do to trigger the crash?

What is the available remediation?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What does an attacker need to do to trigger the crash?

What is the available remediation?

What can be done if updating is not immediately possible?