CVE-2011-2900: Shttpd

High severity, CVSS 7.5. EPSS: 13.3% chance of exploitation in the next 30 days.

Stack-based buffer overflow in the (1) put_dir function in mongoose.c in Mongoose 3.0, (2) put_dir function in yasslEWS.c in yaSSL Embedded Web Server (yasslEWS) 0.2, and (3) _shttpd_put_dir function in io_dir.c in Simple HTTPD (shttpd) 1.42 allows remote attackers to execute arbitrary code via an HTTP PUT request, as exploited in the wild in 2011.

Affected products

• Shttpd Shttpd: version 1.42 only
• Valenok Mongoose: version 3.0 only
• Yassl Yasslews: version 0.2 only

Published 2011-08-05. Last modified 2026-06-16.