A shared library inside Supermicro BMC firmware that parses request headers: An authenticated attacker overflows

Impact

An authenticated attacker overflows a stack buffer during header parsing and executes code in the BMC firmware operating system. The shared-library location is what makes this worth flagging separately: fixing one web endpoint does not fix it, and the same primitive is likely reachable from whichever BMC service an operator has left enabled. Outcome is the usual BMC-root outcome - out-of-band power, console, virtual media and firmware persistence under the host. Because it is shared, the same overflow is reachable from more than one front-end service on the controller rather than from a single CGI endpoint.

Who can reach it

Any authenticated session that reaches a BMC service using this library over the network. Because it is shared code, restricting one interface does not close it.

What to do

Firmware flash from Supermicro's November 2025 BMC/IPMI batch. Disabling individual BMC services is a weaker mitigation than usual here, since the bug lives in shared parsing code rather than one handler - so treat network isolation of the management VLAN plus per-node unique BMC credentials as the interim control, and prioritise the flash. Expect the fixed image to be board-specific.

References