CVE catalog

CVE-2017-17663

mini-httpd: CVE-2017-17663

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.74% · Oct 25, 2026

The htpasswd implementation of mini_httpd before v1.28 and of thttpd before v2.28 is affected by a buffer overflow that can be exploited remotely to perform code execution.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmini-httpdsid1.30-18vulnerable
Debianmini-httpdforky1.30-18vulnerable
Debianmini-httpdtrixie1.30-13vulnerable
Debianmini-httpdbookworm1.30-3vulnerable
Alpinemini_httpd3.101.29-r0fixed
Alpinemini_httpd3.111.29-r0fixed
Alpinemini_httpd3.121.29-r0fixed
Alpinemini_httpd3.131.29-r0fixed
Alpinemini_httpd3.141.29-r0fixed
Alpinemini_httpd3.151.29-r0fixed
Alpinemini_httpd3.161.29-r0fixed
Alpinemini_httpd3.171.29-r0fixed
Alpinemini_httpd3.181.29-r0fixed
Alpinemini_httpd3.191.29-r0fixed
Alpinemini_httpd3.201.29-r0fixed
Alpinemini_httpd3.211.29-r0fixed
Alpinemini_httpd3.221.29-r0fixed
Alpinemini_httpd3.231.29-r0fixed
Alpinemini_httpd3.241.29-r0fixed
Alpinemini_httpd3.81.29-r0fixed
Alpinemini_httpd3.91.29-r0fixed
Opensusethttpdtumbleweed2.29-3.9fixed
Ubuntumini-httpdpro1.23-1.2vulnerable
Ubuntumini-httpdpro1.23-1.2build1vulnerable
Ubuntumini-httpdpro1.23-1.2ubuntu0.1~esm1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmini-httpdsourcesid(unfixed)unimportantNot reportedNot reported
Debianmini-httpdsourceforky(unfixed)unimportantNot reportedNot reported
Debianmini-httpdsourcetrixie(unfixed)unimportantNot reportedNot reported
Debianmini-httpdsourcebookworm(unfixed)unimportantNot reportedNot reported
Alpinemini_httpdapk3.101.29-r0Not reportedALPINE-CVE-2017-17663Not reported
Alpinemini_httpdapk3.111.29-r0Not reportedALPINE-CVE-2017-17663Not reported
Alpinemini_httpdapk3.121.29-r0Not reportedALPINE-CVE-2017-17663Not reported
Alpinemini_httpdapk3.131.29-r0Not reportedALPINE-CVE-2017-17663Not reported
Alpinemini_httpdapk3.141.29-r0Not reportedALPINE-CVE-2017-17663Not reported
Alpinemini_httpdapk3.151.29-r0Not reportedALPINE-CVE-2017-17663Not reported
Alpinemini_httpdapk3.161.29-r0Not reportedALPINE-CVE-2017-17663Not reported
Alpinemini_httpdapk3.171.29-r0Not reportedALPINE-CVE-2017-17663Not reported
Alpinemini_httpdapk3.181.29-r0Not reportedALPINE-CVE-2017-17663Not reported
Alpinemini_httpdapk3.191.29-r0Not reportedALPINE-CVE-2017-17663Not reported
Alpinemini_httpdapk3.201.29-r0Not reportedALPINE-CVE-2017-17663Not reported
Alpinemini_httpdapk3.211.29-r0Not reportedALPINE-CVE-2017-17663Not reported
Alpinemini_httpdapk3.221.29-r0Not reportedALPINE-CVE-2017-17663Not reported
Alpinemini_httpdapk3.231.29-r0Not reportedALPINE-CVE-2017-17663Not reported
Alpinemini_httpdapk3.241.29-r0Not reportedALPINE-CVE-2017-17663Not reported
Alpinemini_httpdapk3.81.29-r0Not reportedALPINE-CVE-2017-17663Not reported
Alpinemini_httpdapk3.91.29-r0Not reportedALPINE-CVE-2017-17663Not reported
Opensusethttpdrpmtumbleweed2.29-3.9Not reportedOPENSUSE-SU-2024:11460-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [mini-httpd]Affected
    Details (2)

    • 1.30-3 · amd64 · bookworm

      Affected

      dsa · mini-httpd · debian · bookworm; dsa · mini-httpd · debian · 12

    • 1.30-3 · arm64 · bookworm

      Affected

      dsa · mini-httpd · debian · bookworm; dsa · mini-httpd · debian · 12

[Debian 13 (Trixie)]

  • [mini-httpd]Affected
    Details (2)

    • 1.30-13 · amd64 · trixie

      Affected

      dsa · mini-httpd · debian · 13

    • 1.30-13 · arm64 · trixie

      Affected

      dsa · mini-httpd · debian · 13

[openSUSE Tumbleweed]

  • [thttpd]Fixed

    Source package: [thttpd]

    Details (1)

    • 2.29-6.7 · x86_64 · tumbleweed

      Fixed · Fixed: 2.29-3.9

      dsa · thttpd · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]