2 files changed, 19 insertions, 4 deletions
diff --git a/nixpkgs/pkgs/development/libraries/libmicrohttpd/0.9.70.nix b/nixpkgs/pkgs/development/libraries/libmicrohttpd/0.9.69.nix
index c0321e327c52..866658c224f3 100644
--- a/nixpkgs/pkgs/development/libraries/libmicrohttpd/0.9.70.nix
+++ b/nixpkgs/pkgs/development/libraries/libmicrohttpd/0.9.69.nix
@@ -1,10 +1,10 @@
 { callPackage, fetchurl }:
 
 callPackage ./generic.nix ( rec {
-  version = "0.9.70";
+  version = "0.9.69";
 
   src = fetchurl {
     url = "mirror://gnu/libmicrohttpd/libmicrohttpd-${version}.tar.gz";
-    sha256 = "01vkjy89b1ylmh22dy5yza2r414nfwcfixxh3v29nvzrjv9s7l4h";
+    sha256 = "sha256-+5trFIt4dJPmN9MINYhxHmXLy3JvoCzuLNVDxd4n434=";
   };
 })
diff --git a/nixpkgs/pkgs/development/libraries/libmicrohttpd/generic.nix b/nixpkgs/pkgs/development/libraries/libmicrohttpd/generic.nix
index 336b66ac8323..d5bc619e9042 100644
--- a/nixpkgs/pkgs/development/libraries/libmicrohttpd/generic.nix
+++ b/nixpkgs/pkgs/development/libraries/libmicrohttpd/generic.nix
@@ -1,9 +1,24 @@
-{ lib, stdenv, libgcrypt, curl, gnutls, pkg-config, libiconv, libintl, version, src }:
+{ lib, stdenv, libgcrypt, curl, gnutls, pkg-config, libiconv, libintl, version, src, meta ? {}, fetchpatch }:
+
+let
+  meta_ = meta;
+in
 
 stdenv.mkDerivation rec {
   pname = "libmicrohttpd";
   inherit version src;
 
+  patches = lib.optionals (lib.versionOlder version "0.9.76") [
+    (fetchpatch {
+      name = "CVE-2023-27371.patch";
+      url = "https://git.gnunet.org/libmicrohttpd.git/patch/?id=e0754d1638c602382384f1eface30854b1defeec";
+      hash = "sha256-vzrq9HPysGpc13rFEk6zLPgpUqp/ST4q/Wp30Dam97k=";
+      excludes = [
+        "ChangeLog"
+      ];
+    })
+  ];
+
   outputs = [ "out" "dev" "devdoc" "info" ];
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libgcrypt curl gnutls libiconv libintl ];
@@ -30,5 +45,5 @@ stdenv.mkDerivation rec {
 
     maintainers = with maintainers; [ eelco vrthra fpletz ];
     platforms = platforms.unix;
-  };
+  } // meta_;
 }