CVE-2011-2900: Stack-based buffer overflow in the (1) put_dir function in mongoose.c in Mongoose 3.0, (2) put_dir function in

This week

HIGH 7.5DOWNGRADEDOWNGRADEDOWNGRADE

CVE-2011-2900 is a high-severity flaw (CVSS 7.5) affecting shttpd, mongoose, yasslews. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Stack-based buffer overflow in the (1) put_dir function in mongoose.c in Mongoose 3.0, (2) put_dir function in yasslEWS.c in yaSSL Embedded Web Server (yasslEWS) 0.2, and (3) _shttpd_put_dir function in io_dir.c in Simple HTTPD (shttpd) 1.42 allows remote attackers to execute arbitrary code via an HTTP PUT request, as exploited in the wild in 2011.

Why this priority

High severity
EPSS top 4%: very likely to be exploited
Public exploit reference

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	7.5 (High)
EPSS exploit chance	13.3% (top 4%)
CISA exploited list	No
Weakness	CWE-119
Published	2011-08-05
Last modified	2026-06-16

Publisher (CNA): Red Hat, Inc. · Vendor: shttpd · valenok · yassl

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2011-08-05 21:55 UTCPublished CVE record published
2026-06-16 23:32 UTCUpdated Record last modified

shttpd shttpd DOWNGRADE

Affected: 1.42

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.42

1. Check installed version

apt-cache policy shttpd || rpm -q shttpd || shttpd --version

2. No fixed release: DOWNGRADE to a release before 1.42 (Debian / Ubuntu)

apt-cache madison shttpd sudo apt install shttpd=<VERSION_BEFORE_1.42> sudo apt-mark hold shttpd

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list shttpd sudo dnf downgrade shttpd-<VERSION_BEFORE_1.42> sudo dnf versionlock add shttpd

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

valenok mongoose DOWNGRADE

Affected: 3.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 3.0

1. Check installed version

apt-cache policy mongoose || rpm -q mongoose || mongoose --version

2. No fixed release: DOWNGRADE to a release before 3.0 (Debian / Ubuntu)

apt-cache madison mongoose sudo apt install mongoose=<VERSION_BEFORE_3.0> sudo apt-mark hold mongoose

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list mongoose sudo dnf downgrade mongoose-<VERSION_BEFORE_3.0> sudo dnf versionlock add mongoose

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

yassl yasslews DOWNGRADE

Affected: 0.2

Fixed in: no fixed release known

Safe to downgrade to: a release before 0.2

1. Check installed version

apt-cache policy yasslews || rpm -q yasslews || yasslews --version

2. No fixed release: DOWNGRADE to a release before 0.2 (Debian / Ubuntu)

apt-cache madison yasslews sudo apt install yasslews=<VERSION_BEFORE_0.2> sudo apt-mark hold yasslews

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list yasslews sudo dnf downgrade yasslews-<VERSION_BEFORE_0.2> sudo dnf versionlock add yasslews

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Exploit-DB: Simple HTTPd 1.42 - Denial of Servive
Exploit-DB: Simple HTTPd 1.42 - 'PUT' Remote Buffer Overflow

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2011-2900?

shttpd: downgrade or apply the listed mitigation; mongoose: downgrade or apply the listed mitigation; yasslews: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2011-2900 being exploited?

CVE-2011-2900 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2011-2900 affect?

CVE-2011-2900 affects shttpd, mongoose, yasslews. Severity is high (CVSS 7.5). Stack-based buffer overflow in the (1) put_dir function in mongoose.c in Mongoose 3.0, (2) put_dir function in yasslEWS.c in yaSSL Embedded Web Server (yasslEWS) 0.2, and (3) _shttpd_put_dir function in io_dir.c in Simple HTTPD (shttpd) 1.4

How urgent is CVE-2011-2900?

Priority 55/100. High severity; EPSS top 4%: very likely to be exploited; Public exploit reference

Software pages

Apache HTTP Server vulnerabilities

Related CVEs

CVE-2007-6405 MEDIUM 6.4 DOWNGRADE Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to download arbitrary
CVE-2007-3541 MEDIUM 4.3 UPGRADE Cross-site scripting (XSS) vulnerability in Kurinton sHTTPd 20070408 and earlier allows remote attackers to in

References

← Back to latest CVEs