CVE-2021-26843 Denial of service in n/a
A crafted HTTP GET request can crash the sthttpd daemon due to overlapping memory ranges in the de_dotdot function, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-26843?
CVE-2021-26843 is a high-severity denial of service vulnerability in n/a, published on 7 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in sthttpd through 2.27.1. On systems where the strcpy function is implemented with memcpy, the de_dotdot function may cause a Denial-of-Service (daemon crash) due to overlapping memory ranges being passed to memcpy. This can triggered with an HTTP GET request for a crafted filename. NOTE: this is similar to CVE-2017-10671, but occurs in a different part of the de_dotdot function.
Weakness: CWE-119
Which versions are affected by CVE-2021-26843?
It affects 1 product.
Products include Sthttpd Project Sthttpd.
How do I fix CVE-2021-26843?
No fix has been published for CVE-2021-26843 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-26843 being exploited?
There is no known exploitation of CVE-2021-26843 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-67j3-q5rv-5gjr.