CVE-2024-23771

9.8CRITICAL

darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.

Published: 1/22/2024Updated: 5/30/2025
View on NVDView on MITRE

Description

darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.

AI AnalysisPowered by AI

Affected Products

unix4lyfedarkhttpd

References