CVE-2026-32854

Name	CVE-2026-32854
Description	LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1132017

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libvncserver (PTS)	bullseye	0.9.13+dfsg-2+deb11u1	vulnerable
	bookworm	0.9.14+dfsg-1	vulnerable
	trixie	0.9.15+dfsg-1	vulnerable
	forky, sid	0.9.15+dfsg-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libvncserver	source	(unstable)	0.9.15+dfsg-3			1132017

Notes

https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x
Fixed by: https://github.com/LibVNC/libvncserver/commit/dc78dee51a7e270e537a541a17befdf2073f5314