CVE-2017-10671: Heap-based Buffer Overflow in the de_dotdot function in libhttpd.c in sthttpd before 2.27.1 allows remote a...

Security readout for executives and security teams

CVE-2017-10671 is a memory corruption flaw in sthttpd before 2.27.1. A remote user could send a crafted filename that crashes the web server daemon. The sources also mention possible unspecified other impact, but do not prove code execution or active exploitation. Exposure is limited to environments running sthttpd before 2.27.1, especially where the HTTP service is reachable by untrusted users. The source bundle does not identify downstream products or package backport status. Treat this as a focused web-service resilience issue. Prioritize internet-facing sthttpd instances and any business-critical service using pre-2.27.1 versions. Lack of CVSS and exploitation evidence reduces urgency compared with KEV-listed flaws. Mitigation focus: Upgrade sthttpd to version 2.27.1 or later.; Check operating system or vendor package advisories for backported fixes.; Limit untrusted network access to affected sthttpd services where possible..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.