Executive Summary

Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests that contain '<' or '>' characters, which trigger the overflow when the characters are expanded to "<" and ">" sequences.

Why It Matters

CVE-2003-0899 is rated CRITICAL severity, requiring immediate attention from security teams.

CVSS Base Score: 9.8/10

Affected Technologies

Vendors: acme

Products: thttpd

🛡️What Defenders Should Check

Check if you are affected — Review your asset inventory for products listed in CVE-2003-0899.

Apply available patches — Visit vendor advisories for the latest security updates.

Monitor for exploitation — Check your SIEM/IDS logs for related indicators.

Use Vulnios to continuously monitor your exposure to CVE-2003-0899 and similar vulnerabilities.

References & Sources

http://marc.info/?l=bugtraq&m=106729188224252&w=2

http://secunia.com/advisories/10092

http://www.osvdb.org/2729

http://www.securityfocus.com/bid/8906

http://www.texonet.com/advisories/TEXONET-20030908.txt

https://exchange.xforce.ibmcloud.com/vulnerabilities/13530

https://www.debian.org/security/2003/dsa-396

http://marc.info/?l=bugtraq&m=106729188224252&w=2

http://secunia.com/advisories/10092

http://www.osvdb.org/2729

AI Security Advisor

Get AI-powered security recommendations tailored to this specific threat — including risk assessment, detection guidance, MITRE ATT&CK mapping, and actionable remediation steps.

Affected Products

thttpd

Sources

NVD / NIST

critical

Protect Your Organization

Monitor CVEs, scan for vulnerabilities, and get real-time threat alerts — all in one platform.

Get Started Free Free Security Scan OSINT Dashboard

Get instant alerts on Telegram

Join our public channel for real-time critical CVE alerts.

Follow @vulnios

Critical Vulnerability: CVE-2003-0899 — acme — thttpd