Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

poco 1.14.1 may crash on crafted multipart input

published 24 days ago

Summary

The Poco C++ library up to version 1.14.1 can crash when it processes a specially crafted multipart message, which could stop the application that relies on it. This can be triggered by someone who has local access to the system. Upgrade to Poco version 1.14.2 or newer to resolve the issue.

What to do

Update openeuler poco to version 1.12.5p2-3.oe2403sp1.

Affected software

Ecosystem	Vendor	Product	Affected versions
openEuler:24.03-LTS-SP1	openeuler	poco	< 1.12.5p2-3.oe2403sp1 Fix: upgrade to 1.12.5p2-3.oe2403sp1

Original advisory text

poco security update

This is ROS melodic ros_comm&apos;s 3rdparty poco.

Security Fix(es):

A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStream of the file Net/src/MultipartReader.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.14.2 is able to address this issue. The patch is identified as 6f2f85913c191ab9ddfb8fae781f5d66afccf3bf. It is recommended to upgrade the affected component.(CVE-2025-6375)

References

https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-6375 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

3.3 Low

Timeline

Published25 Sep 2026

Updated30 Sep 2026

First seen30 Sep 2026

Sources

OESA-2026-4091 · OSV

Track software like this

Free during beta