CVE-2017-17663: Acme Mini Httpd

Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days.

The htpasswd implementation of mini_httpd before v1.28 and of thttpd before v2.28 is affected by a buffer overflow that can be exploited remotely to perform code execution.

Affected products

• Acme Mini Httpd: before 1.28 (fixed in 1.28)
• Acme Thttpd: before 2.28 (fixed in 2.28)

Published 2018-02-06. Last modified 2026-06-17.