Critical severity9.8NVD Advisory· Published Nov 3, 2003· Updated Apr 16, 2026

CVE-2003-0899

Description

Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests that contain '<' or '>' characters, which trigger the overflow when the characters are expanded to "<" and ">" sequences.

Affected products

Acme/Thttpd3 versions
cpe:2.3:a:acme:thttpd:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:acme:thttpd:*:*:*:*:*:*:*:*range: >=2.21,<2.23
- cpe:2.3:a:acme:thttpd:2.23:-:*:*:*:*:*:*
- cpe:2.3:a:acme:thttpd:2.23:b1:*:*:*:*:*:*

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

secunia.com/advisories/10092nvdBroken LinkPatchVendor Advisory
marc.infonvdExploitMailing List
www.securityfocus.com/bid/8906nvdBroken LinkExploitPatchThird Party AdvisoryVDB Entry
exchange.xforce.ibmcloud.com/vulnerabilities/13530nvdThird Party AdvisoryVDB Entry
www.osvdb.org/2729nvdBroken Link
www.texonet.com/advisories/TEXONET-20030908.txtnvdBroken LinkURL Repurposed
www.debian.org/security/2003/dsa-396nvdBroken Link

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.016
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000