CVE-2024-23771
darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which...
darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.
- Record
CVE-2024-23771- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-203
- Updated
- 2026-11-02
CVE List
darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.
- Record
CVE-2024-23771- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-203
- Updated
- 2026-11-02
EUVDEUVD-2024-21224
darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.
- Record
EUVD-2024-21224- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8cwm-wr6q-x76p
darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which...
darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.
- Record
GHSA-8cwm-wr6q-x76p- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-203
- Updated
- 2026-11-02
OSVALPINE-CVE-2024-23771
darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.
- Record
ALPINE-CVE-2024-23771- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.
- Record
CVE-2024-23771- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVROOT-OS-ALPINE-318-CVE-2024-23771 No score
CVE-2024-23771 in darkhttpd - Patched by Root
Root has patched CVE-2024-23771 in the darkhttpd package for Root:Alpine:3.18. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-318-CVE-2024-23771- Updated
- 2026-11-02
OSVROOT-OS-ALPINE-319-CVE-2024-23771 No score
CVE-2024-23771 in darkhttpd - Patched by Root
Root has patched CVE-2024-23771 in the darkhttpd package for Root:Alpine:3.19. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-319-CVE-2024-23771- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
darkhttpdAlpine:v3.20 |
before 1.15-r0 | 1.15-r0 |
darkhttpdAlpine:v3.21 |
before 1.15-r0 | 1.15-r0 |
darkhttpdAlpine:v3.22 |
before 1.15-r0 | 1.15-r0 |
darkhttpdAlpine:v3.23 |
before 1.15-r0 | 1.15-r0 |
darkhttpdAlpine:v3.24 |
before 1.15-r0 | 1.15-r0 |
darkhttpdRoot:Alpine:3.18 |
before 1.14-r10072 | 1.14-r100721.14-r100711.14-r100751.14-r100741.14-r10073 |
rootio-darkhttpdRoot:Alpine:3.18 |
before 1.14-r10072 | 1.14-r100721.14-r100711.14-r100751.14-r100741.14-r10073 |
darkhttpdRoot:Alpine:3.19 |
before 1.14-r10074 | 1.14-r100741.14-r100711.14-r100731.14-r100721.14-r10075 |
rootio-darkhttpdRoot:Alpine:3.19 |
before 1.14-r10074 | 1.14-r100741.14-r100711.14-r100731.14-r100721.14-r10075 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-23771 is a critical vulnerability (CVSS 9.8) in Unix4lyfe Darkhttpd, published January 22, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.05%, the 64th percentile. Fixed in darkhttpd 1.15-r0.
References
github.com/emikulic/darkhttpd/compare/v1.14...v1.15
openwall.com/lists/oss-security/2024/01/25/1
nvd.nist.gov/vuln/detail/CVE-2024-23771
security.alpinelinux.org/vuln/CVE-2024-23771