CVE-2003-0899

CRITICAL

thttpd 2.21-2.23b1 - Remote Code Execution via Defang Buffer Overflow

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2003-0899. PoCs published by d3ck4, Joel Soderberg.

AI-analyzed exploit summary This exploit targets a buffer overflow vulnerability in thttpd's defang() function by sending a maliciously crafted HTTP GET request with an overly long path. The exploit is designed to cause a denial-of-service (DoS) by crashing the thttpd daemon.

Description

Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests that contain '<' or '>' characters, which trigger the overflow when the characters are expanded to "<" and ">" sequences.

Exploits (2)

exploitdb WORKING POC VERIFIED

by d3ck4 · cremotelinux

https://www.exploit-db.com/exploits/23306

View Code ZIP pw:eip

This exploit targets a buffer overflow vulnerability in thttpd's defang() function by sending a maliciously crafted HTTP GET request with an overly long path. The exploit is designed to cause a denial-of-service (DoS) by crashing the thttpd daemon.

Classification

Working Poc 90%

Attack Type

Dos

Complexity

Trivial

Reliability

Reliable

Target: thttpd versions 2.21 to 2.23b1

No auth needed

Prerequisites: Network access to the target thttpd server

MITRE ATT&CK

T1499 - Endpoint Denial of Service

devstral-2 · analyzed Feb 16, 2026 Full analysis →

exploitdb WRITEUP VERIFIED

by Joel Soderberg · cdoslinux

https://www.exploit-db.com/exploits/23305

View Code ZIP pw:eip

The code is a snippet of the vulnerable `defang()` function from thttpd, which lacks bounds checking and can lead to a buffer overflow. It does not contain an exploit but explains the vulnerability.

Classification

Writeup 90%

Attack Type

Rce

Complexity

Moderate

Reliability

Theoretical

Target: thttpd versions 2.21 to 2.23b1

No auth needed

Prerequisites: Network access to the vulnerable thttpd server

MITRE ATT&CK