CVE-2003-0899: Acme Thttpd

Critical severity, CVSS 9.8. EPSS: 22.2% chance of exploitation in the next 30 days.

Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests that contain '<' or '>' characters, which trigger the overflow when the characters are expanded to "&lt;" and "&gt;" sequences.

Affected products

• Acme Thttpd: from 2.21, before 2.23 (fixed in 2.23); version 2.23 only

Published 2003-11-03. Last modified 2026-06-16.