Unscored DSA-396 2 CVEs

thttpd - missing input sanitizing, wrong calculation

Published Oct 29, 2003 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 3.0	thttpd	2.21b-11.2

Vulnerabilities 2

Unscored —

CVE-2002-1562

Directory traversal vulnerability in thttpd, when using virtual hosting, allows remote attackers to read arbitrary file…

Apr 26, 2003
Unscored —

CVE-2003-0899 Public exploit EPSS 22%

Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via…

Oct 30, 2003