CVE-2024-23771

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
22/01/2024
Last modified:
30/05/2025

Description

darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:unix4lyfe:darkhttpd:*:*:*:*:*:*:*:* 1.15 (excluding)