https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2007-0158.htmlhttps://patchthecve.com/cve/CVE-2007-0158.htmlTue, 16 Jun 2026 22:35:01 +0000CRITICAL 9.8: thttpd 2007 has buffer underflow.https://patchthecve.com/cve/CVE-2012-5640.htmlhttps://patchthecve.com/cve/CVE-2012-5640.htmlTue, 16 Jun 2026 23:47:08 +0000MEDIUM 5.5: thttpd has a local DoS vulnerability via specially-crafted .htpasswd fileshttps://patchthecve.com/cve/CVE-2017-17663.htmlhttps://patchthecve.com/cve/CVE-2017-17663.htmlWed, 17 Jun 2026 01:11:27 +0000CRITICAL 9.8: The htpasswd implementation of mini_httpd before v1.28 and of thttpd before v2.28 is affected by a buffer overflow that can be exploited remotely to perform code execution.https://patchthecve.com/cve/CVE-2013-0348.htmlhttps://patchthecve.com/cve/CVE-2013-0348.htmlTue, 16 Jun 2026 23:49:16 +0000LOW 2.1: thttpd.c in sthttpd before 2.26.4-r2 and thttpd 2.25b use world-readable permissions for /var/log/thttpd.log, which allows local users to obtain sensitive information by reading the file.https://patchthecve.com/cve/CVE-2009-4491.htmlhttps://patchthecve.com/cve/CVE-2009-4491.htmlTue, 16 Jun 2026 23:13:46 +0000CRITICAL 9.8: thttpd 2.25b0 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.https://patchthecve.com/cve/CVE-2007-0664.htmlhttps://patchthecve.com/cve/CVE-2007-0664.htmlTue, 16 Jun 2026 22:36:01 +0000MEDIUM 5.0: thttpd before 2.25b-r6 in Gentoo Linux is started from the system root directory (/) by the Gentoo baselayout 1.12.6 package, which allows remote attackers to read arbitrary files.https://patchthecve.com/cve/CVE-2006-4248.htmlhttps://patchthecve.com/cve/CVE-2006-4248.htmlTue, 16 Jun 2026 22:28:42 +0000HIGH 7.2: thttpd on Debian GNU/Linux, and possibly other distributions, allows local users to create or touch arbitrary files via a symlink attack on the start_thttpd temporary file.https://patchthecve.com/cve/CVE-2006-1079.htmlhttps://patchthecve.com/cve/CVE-2006-1079.htmlTue, 16 Jun 2026 22:21:59 +0000HIGH 7.2: htpasswd, as used in Acme thttpd 2.25b and possibly other products such as Apache, might allow local users to gain privileges via shell metacharacters in a command line argument, which is used in a call to the system function. NOTE: since htpasswd is normally installed as a non-setuid program, and https://patchthecve.com/cve/CVE-2006-1078.htmlhttps://patchthecve.com/cve/CVE-2006-1078.htmlTue, 16 Jun 2026 22:21:58 +0000HIGH 8.4: Multiple buffer overflows in htpasswd, as used in Acme thttpd 2.25b, and possibly other products such as Apache, might allow local users to gain privileges via (1) a long command line argument and (2) a long line in a file. NOTE: since htpasswd is normally installed as a non-setuid program, and thehttps://patchthecve.com/cve/CVE-2005-3124.htmlhttps://patchthecve.com/cve/CVE-2005-3124.htmlTue, 16 Jun 2026 22:16:17 +0000LOW 2.1: syslogtocern in Acme thttpd before 2.23 allows local users to write arbitrary files via a symlink attack on a temporary file.https://patchthecve.com/cve/CVE-2004-2628.htmlhttps://patchthecve.com/cve/CVE-2004-2628.htmlTue, 16 Jun 2026 22:10:00 +0000MEDIUM 5.0: Multiple directory traversal vulnerabilities in thttpd 2.07 beta 0.4, when running on Windows, allow remote attackers to read arbitrary files via a URL that contains (1) a hex-encoded backslash dot-dot sequence ("%5C..") or (2) a drive letter (such as "C:").https://patchthecve.com/cve/CVE-2003-0899.htmlhttps://patchthecve.com/cve/CVE-2003-0899.htmlTue, 16 Jun 2026 22:03:09 +0000CRITICAL 9.8: Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests that contain '<' or '>' characters, which trigger the overflow when the characters are expanded to "&lt;" and "&gt;" sequences.https://patchthecve.com/cve/CVE-2002-1562.htmlhttps://patchthecve.com/cve/CVE-2002-1562.htmlTue, 16 Jun 2026 21:59:33 +0000MEDIUM 5.0: Directory traversal vulnerability in thttpd, when using virtual hosting, allows remote attackers to read arbitrary files via .. (dot dot) sequences in the Host: header.https://patchthecve.com/cve/CVE-2002-0733.htmlhttps://patchthecve.com/cve/CVE-2002-0733.htmlTue, 16 Jun 2026 21:58:01 +0000HIGH 7.5: Cross-site scripting vulnerability in thttpd 2.20 and earlier allows remote attackers to execute arbitrary script via a URL to a nonexistent page, which causes thttpd to insert the script into a 404 error message.https://patchthecve.com/cve/CVE-2001-1496.htmlhttps://patchthecve.com/cve/CVE-2001-1496.htmlTue, 16 Jun 2026 21:56:22 +0000CRITICAL 9.8: Off-by-one buffer overflow in Basic Authentication in Acme Labs thttpd 1.95 through 2.20 allows remote attackers to cause a denial of service and possibly execute arbitrary code.https://patchthecve.com/cve/CVE-2001-0892.htmlhttps://patchthecve.com/cve/CVE-2001-0892.htmlTue, 16 Jun 2026 21:55:10 +0000MEDIUM 5.0: Acme Thttpd Secure Webserver before 2.22, with the chroot option enabled, allows remote attackers to view sensitive files under the document root (such as .htpasswd) via a GET request with a trailing /.https://patchthecve.com/cve/CVE-2000-0900.htmlhttps://patchthecve.com/cve/CVE-2000-0900.htmlWed, 23 Sep 2026 09:10:01 +0000HIGH 7.5: Directory traversal vulnerability in ssi CGI program in thttpd 2.19 and earlier allows remote attackers to read arbitrary files via a "%2e%2e" string, a variation of the .. (dot dot) attack.https://patchthecve.com/cve/CVE-2000-0359.htmlhttps://patchthecve.com/cve/CVE-2000-0359.htmlTue, 16 Jun 2026 21:51:33 +0000HIGH 10.0: Buffer overflow in Trivial HTTP (THTTPd) allows remote attackers to cause a denial of service or execute arbitrary commands via a long If-Modified-Since header.