{"id":"CVE-2024-23771","aliases":["ALPINE-CVE-2024-23771","EUVD-2024-21224","GHSA-8cwm-wr6q-x76p","ROOT-OS-ALPINE-318-CVE-2024-23771","ROOT-OS-ALPINE-319-CVE-2024-23771"],"status":"published","title":"darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which...","description":"darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01055,"percentile":0.64831,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-203"],"published":"2024-01-22T00:00:00Z","modified":"2026-11-02T11:17:50Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"darkhttpd","fixed_in":["1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"darkhttpd","fixed_in":["1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"darkhttpd","fixed_in":["1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"darkhttpd","fixed_in":["1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"darkhttpd","fixed_in":["1.15-r0"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.18","package":"darkhttpd","fixed_in":["1.14-r10072","1.14-r10071","1.14-r10075","1.14-r10074","1.14-r10073"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.18","package":"rootio-darkhttpd","fixed_in":["1.14-r10072","1.14-r10071","1.14-r10075","1.14-r10074","1.14-r10073"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.19","package":"darkhttpd","fixed_in":["1.14-r10074","1.14-r10071","1.14-r10073","1.14-r10072","1.14-r10075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.19","package":"rootio-darkhttpd","fixed_in":["1.14-r10074","1.14-r10071","1.14-r10073","1.14-r10072","1.14-r10075"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"darkhttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"darkhttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"darkhttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"darkhttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"darkhttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-r0"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.18","package":"darkhttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-r10072"},{"fixed":"1.14-r10071"},{"fixed":"1.14-r10075"},{"fixed":"1.14-r10074"},{"fixed":"1.14-r10073"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.18","package":"rootio-darkhttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-r10072"},{"fixed":"1.14-r10071"},{"fixed":"1.14-r10075"},{"fixed":"1.14-r10074"},{"fixed":"1.14-r10073"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.19","package":"darkhttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-r10074"},{"fixed":"1.14-r10071"},{"fixed":"1.14-r10073"},{"fixed":"1.14-r10072"},{"fixed":"1.14-r10075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.19","package":"rootio-darkhttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-r10074"},{"fixed":"1.14-r10071"},{"fixed":"1.14-r10073"},{"fixed":"1.14-r10072"},{"fixed":"1.14-r10075"}]}]}],"products":[{"vendor":"unix4lyfe","product":"darkhttpd"}],"references":[{"url":"https://github.com/emikulic/darkhttpd/compare/v1.14...v1.15","tags":["x_transferred","Product","web"]},{"url":"https://github.com/emikulic/darkhttpd/commit/f477619d49f3c4de9ad59bd194265a48ddc03f04","tags":["x_transferred","Patch","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2024/01/25/1","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23771","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8cwm-wr6q-x76p"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-23771","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23771.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-23771","description":"darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.","status":"published","published":"2024-01-22T00:00:00Z","modified":"2025-05-30T14:23:16.116Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:34:05.823187Z"}],"euvd":[{"id":"EUVD-2024-21224","description":"darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.","status":"published","published":"2024-01-22T00:00:00Z","modified":"2025-05-30T14:23:16Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:34.547192Z"}],"ghsa":[{"id":"GHSA-8cwm-wr6q-x76p","title":"darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which...","description":"darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.","status":"published","published":"2024-01-22T06:30:31Z","modified":"2024-02-04T05:06:59Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:55:33.593991Z"}],"nvd":[{"id":"CVE-2024-23771","description":"darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.","status":"published","published":"2024-01-22T04:15:07.723Z","modified":"2026-06-17T07:13:34.32Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:09:32.147098Z"}],"osv":[{"id":"ALPINE-CVE-2024-23771","description":"darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.","status":"published","published":"2024-01-22T04:15:07.723Z","modified":"2026-11-02T11:17:50.074325006Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"CVE-2024-23771","description":"darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.","status":"published","published":"2024-01-22T00:00:00Z","modified":"2026-10-28T10:40:17.428223507Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:38.897406Z"},{"id":"ROOT-OS-ALPINE-318-CVE-2024-23771","title":"CVE-2024-23771 in darkhttpd - Patched by Root","description":"Root has patched CVE-2024-23771 in the darkhttpd package for Root:Alpine:3.18. Multiple fixed versions available.","status":"published","published":"2026-09-29T09:38:25Z","modified":"2026-09-29T10:15:14.3610239Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-OS-ALPINE-319-CVE-2024-23771","title":"CVE-2024-23771 in darkhttpd - Patched by Root","description":"Root has patched CVE-2024-23771 in the darkhttpd package for Root:Alpine:3.19. Multiple fixed versions available.","status":"published","published":"2026-09-29T09:23:36Z","modified":"2026-09-29T10:15:13.20923802Z","updated_at":"2026-11-02T15:53:28.259095Z"}]}}