CVE-2021-26843

HOCH 7.5CVE-2021-26843 · Published 07/02/2021 · updated 17/06/2026

Kurz gesagt

CVE-2021-26843 ist eine Schwachstelle (HOCH (CVSS 7.5)) in sthttpd (sthttpd project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.5%, höher als bei 73.7% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
sthttpd sthttpd_project	`≤ 2.27.1`	No fix yet

Description

An issue was discovered in sthttpd through 2.27.1. On systems where the strcpy function is implemented with memcpy, the de_dotdot function may cause a Denial-of-Service (daemon crash) due to overlapping memory ranges being passed to memcpy. This can triggered with an HTTP GET request for a crafted filename. NOTE: this is similar to CVE-2017-10671, but occurs in a different part of the de_dotdot function.

References

blueness/sthttpd · Exploit

Weitere Schwachstellen in sthttpd

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free