{"id":"CVE-2026-68005","aliases":["DEBIAN-CVE-2026-68005","EUVD-2026-60449","GHSA-wwgh-7wm5-gx34","UBUNTU-CVE-2026-68005"],"status":"published","title":"An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service...","description":"An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handle_request() function","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-08","score":0.00582,"percentile":0.48055,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-08-17T00:00:00Z","modified":"2026-10-24T09:47:33Z","fixes":[{"ecosystem":"Debian:14","package":"mini-httpd","fixed_in":["1.30-18"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mini-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.30-10","1.30-11","1.30-12","1.30-13","1.30-14","1.30-15","1.30-16","1.30-17","1.30-18","1.30-3","1.30-4","1.30-5","1.30-6","1.30-7","1.30-8","1.30-9"]},{"source":"osv","ecosystem":"Debian:13","package":"mini-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.30-13","1.30-14","1.30-15","1.30-16","1.30-17","1.30-18"]},{"source":"osv","ecosystem":"Debian:14","package":"mini-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30-18"}]}],"versions":["1.30-13","1.30-14","1.30-15","1.30-16","1.30-17"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"mini-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19-9.3","1.19-9.3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mini-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19-9.3","1.21-1ubuntu1","1.23-1","1.23-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"mini-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23-1.2","1.23-1.2build1","1.23-1.2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mini-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.30-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mini-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.30-2","1.30-2build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mini-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.30-3","1.30-5","1.30-6","1.30-7","1.30-8","1.30-8build1","1.30-8build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mini-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.30-15","1.30-17","1.30-17build1","1.30-18"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mini-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.30-13","1.30-14","1.30-15"]}],"references":[{"url":"https://acme.com/software/mini_httpd/"},{"url":"https://github.com/qop-qop-qop/qop-s-blog.github.io/blob/main/CVE-2026-68005/CVE-2026-68005.md"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68005"},{"url":"https://acme.com/software/mini_httpd"},{"url":"https://github.com/advisories/GHSA-wwgh-7wm5-gx34"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-68005","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-68005","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68005","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-68005","description":"An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handle_request() function","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-08-17T20:46:19.095Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T13:45:59.110885Z"}],"euvd":[{"id":"EUVD-2026-60449","description":"An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handle_request() function","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-08-17T20:46:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:48.026284Z"}],"ghsa":[{"id":"GHSA-wwgh-7wm5-gx34","title":"An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service...","description":"An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handle_request() function","status":"published","published":"2026-08-17T21:31:24Z","modified":"2026-08-17T21:31:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:10:35.189726Z"}],"nvd":[{"id":"CVE-2026-68005","description":"An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handle_request() function","status":"published","published":"2026-08-17T20:16:45.347Z","modified":"2026-10-23T16:10:00.313Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:38.647684Z"}],"osv":[{"id":"DEBIAN-CVE-2026-68005","description":"An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handle_request() function","status":"published","published":"2026-08-17T20:16:45.347Z","modified":"2026-10-24T09:47:33.695306601Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:01.68444Z"},{"id":"UBUNTU-CVE-2026-68005","description":"An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handle_request() function","status":"published","published":"2026-08-17T20:16:00Z","modified":"2026-10-17T13:00:39.572213565Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:53.710209Z"}]}}