CVE-2001-1496

CRITICAL 9.8CVE-2001-1496 · Published 31/12/2001 · updated 16/06/2026

In short

CVE-2001-1496 is a CRITICAL (CVSS 9.8) vulnerability affecting thttpd (acme).
Chance of exploitation in the next 30 days (EPSS): 4.8%, higher than 92.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
thttpd acme	`≥ 1.95, ≤ 2.20`	No fix yet

Description

Off-by-one buffer overflow in Basic Authentication in Acme Labs thttpd 1.95 through 2.20 allows remote attackers to cause a denial of service and possibly execute arbitrary code.

References

securityfocus.com/archive/1/241310 · Broken Link
securityfocus.com/archive/1/241953 · Broken Link
securityfocus.com/bid/3562 · Broken Link
exchange.xforce.ibmcloud.com/vulnerabilities/7595 · Third Party Advisory

More vulnerabilities in thttpd

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

thttpd

acme

≥ 1.95, ≤ 2.20

No fix yet

More vulnerabilities in thttpd

See all →