How severe is CVE-2003-0899?

CVE-2003-0899 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2003-0899 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 22% (97th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2003-0899?

CVE-2003-0899 primarily affects Acme Thttpd. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2003-0899?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2003-0899 published?

CVE-2003-0899 was published on 2003-11-03 and last updated on 2026-06-16.

CVE-2003-0899

CVE-2003-0899 is a critical-severity vulnerability in Acme Thttpd with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 22% places it in the 97th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-131.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 7.5
EPSS exploit prediction: 22% (97th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-131
Affected product: Acme Thttpd
Published: 2003-11-03
Last modified: 2026-06-16

Description

Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests that contain '<' or '>' characters, which trigger the overflow when the characters are expanded to "<" and ">" sequences.

Frequently asked questions

What is CVE-2003-0899?: Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests that contain '<' or '>' characters, which trigger the overflow when the characters are expanded to "<" and ">" sequences.
How severe is CVE-2003-0899?: CVE-2003-0899 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2003-0899 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 22% (97th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2003-0899?: CVE-2003-0899 primarily affects Acme Thttpd. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2003-0899?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2003-0899 published?: CVE-2003-0899 was published on 2003-11-03 and last updated on 2026-06-16.

References

Affected products (3)

cpe:2.3:a:acme:thttpd:*:*:*:*:*:*:*:*
cpe:2.3:a:acme:thttpd:2.23:-:*:*:*:*:*:*
cpe:2.3:a:acme:thttpd:2.23:b1:*:*:*:*:*:*

More vulnerabilities in Acme Thttpd

CVE-2007-0158 — Critical (CVSS 9.8): thttpd 2007 has buffer underflow.
CVE-2017-17663 — Critical (CVSS 9.8): The htpasswd implementation of mini_httpd before v1.28 and of thttpd before v2.28 is affected by a buffer overflow that…
CVE-2009-4491 — Critical (CVSS 9.8): thttpd 2.25b0 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers…
CVE-2001-1496 — Critical (CVSS 9.8): Off-by-one buffer overflow in Basic Authentication in Acme Labs thttpd 1.95 through 2.20 allows remote attackers to…
CVE-2012-5640 — Medium (CVSS 5.5): thttpd has a local DoS vulnerability via specially-crafted .htpasswd files
CVE-2001-0892 — Medium (CVSS 5.0): Acme Thttpd Secure Webserver before 2.22, with the chroot option enabled, allows remote attackers to view sensitive…

All CVEs affecting Acme Thttpd →

Other CWE-131 (Incorrect Calculation of Buffer Size) vulnerabilities

CVE-2026-52955 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in…
CVE-2026-41676 — Critical (CVSS 9.8): rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78,…
CVE-2026-1949 — Critical (CVSS 9.8): Delta Electronics AS320T has incorrect calculation of the buffer size on the stack in the GET/PUT request handler of…
CVE-2026-20911 — Critical (CVSS 9.8): A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and…
CVE-2025-1861 — Critical (CVSS 9.8): In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when…
CVE-2023-5941 — Critical (CVSS 9.8): In versions of FreeBSD 12.4-RELEASE prior to 12.4-RELEASE-p7 and FreeBSD 13.2-RELEASE prior to 13.2-RELEASE-p5 the…

Browse all CWE-131 (Incorrect Calculation of Buffer Size) vulnerabilities →