CVE-2021-26843

An issue was discovered in sthttpd through 2.27.1. On systems where the strcpy function is implemented with memcpy, the dedotdot function may cause a Denial-of-Service daemon crash due to overlapping memory ranges being passed to memcpy. This can triggered with an HTTP GET request for a crafted...

CVE-2021-26843

The connected sources confirm a vulnerability in sthttpd up to version 2.27.1 involving the de_dotdot function in libhttpd.c. When the C strcpy is implemented via memcpy, overlapping memory regions passed to memcpy during de_dotdot can trigger a Denial-of-Service (daemon crash) via a crafted HTTP...