CVE-2025-6375: 
NixOS vulnerability analysis and mitigation

CVE-2025-6375 is a NULL pointer dereference vulnerability in the POCO C++ Libraries affecting the MultipartInputStream function in Net/src/MultipartReader.cpp. It affects all POCO versions up to and including 1.14.1, and was discovered through fuzzing and reported by Yifan Zhang on March 30, 2025, with public disclosure on June 21, 2025. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium), with availability as the sole impacted dimension (Feedly, GitHub Issue).

The root cause is a NULL pointer dereference (CWE-476) combined with improper resource shutdown (CWE-404) in the MultipartStreamBuf constructor within Net/src/MultipartReader.cpp. The original code placed a poco_assert boundary check (!boundary.empty() && boundary.length() < STREAM_BUFFER_SIZE - 6) inside the constructor, but the assertion was evaluated before the stream buffer was fully initialized, leading to a SEGV when a malformed multipart HTTP request with an empty or missing boundary string was processed. The fix (commit 6f2f85913c191ab9ddfb8fae781f5d66afccf3bf) moved the assertion out of the constructor and into the readFromDevice() method where the buffer length is available for proper validation. A proof-of-concept crash input — a crafted HTTP POST with Content-Type: multipart/form-data;boundary -- and an empty boundary — has been publicly disclosed (GitHub Commit, GitHub Issue).

Successful exploitation causes the application using the POCO library to crash (SIGSEGV), resulting in a denial of service. There is no impact on confidentiality or integrity — only availability is affected. Applications that parse multipart HTTP form data using Poco::Net::HTMLForm or Poco::Net::MultipartReader are directly at risk of process termination when processing malformed input (Feedly, GitHub Issue).

A proof-of-concept crash file (poco_crash.txt) has been publicly disclosed on GitHub, demonstrating the ability to trigger the SEGV via a crafted multipart HTTP request with an empty boundary value. The CVSS v4.0 exploit maturity is rated as PROOF_OF_CONCEPT. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of widespread exploitation. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (GitHub PoC, Feedly).

1. Identify target: Locate an application that uses POCO library versions ≤ 1.14.1 and processes multipart HTTP form data (e.g., via Poco::Net::HTMLForm::load() or Poco::Net::MultipartReader).
2. Craft malicious request: Construct an HTTP POST request with a Content-Type header specifying multipart/form-data but with an empty or missing boundary value, e.g., Content-Type: multipart/form-data;boundary -- with no actual boundary string.
3. Submit the request: Send the crafted request to the target application's HTTP endpoint that parses multipart form data. The public PoC input is simply: POST 0 0 Content-Type:multipart/form-data;boundary --.
4. Trigger crash: The MultipartInputStream constructor passes the empty boundary to MultipartStreamBuf, which triggers the misplaced assertion or dereferences a null/invalid pointer at MultipartReader.cpp:164, causing a SIGSEGV and crashing the application process (GitHub Issue, GitHub PoC).

• Logs: Application crash logs or core dumps referencing Poco::Net::MultipartInputStream::MultipartInputStream or Net/src/MultipartReader.cpp:164; AddressSanitizer output showing SEGV on unknown address in std::ios_base::~ios_base().
• Process: Unexpected termination of the POCO-based application process; repeated process restarts by a supervisor/service manager.
• Network: Unusual HTTP POST requests to multipart-handling endpoints with malformed or empty boundary values in the Content-Type: multipart/form-data header (e.g., Content-Type: multipart/form-data;boundary -- with no boundary token) (GitHub Issue).

Upgrade the POCO library to version 1.14.2 or later, which includes the fix in commit 6f2f85913c191ab9ddfb8fae781f5d66afccf3bf that moves the boundary validation assertion to the correct location in readFromDevice(). As a temporary workaround, restrict local system access and implement upstream input validation to reject multipart requests with empty or missing boundary strings before they reach the POCO library. Red Hat has tracked this issue with low priority, and Debian has packaged version 1.14.2-1 (GitHub Release, Red Hat Bugzilla).

Red Hat's Product Security team filed a Bugzilla entry (Bug 2374140) and assigned it low severity and priority, indicating limited concern for downstream Red Hat products. The vulnerability was discovered via fuzzing and reported by researcher Yifan Zhang, reflecting the value of fuzz testing in identifying memory safety issues in C++ networking libraries. No significant broader media coverage or notable community debate has been observed (Red Hat Bugzilla, GitHub Issue).