Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-23771: darkhttpd on Alpine can allow unauthorized code execution

CVE-2024-23771 · published 3 days ago

Summary

The darkhttpd web server included in Alpine Linux can be tricked into running unwanted code. This could let an attacker take control of the server or steal data. Update darkhttpd to the latest version provided by Alpine to close the risk.

What to do

Update alpine rootio-darkhttpd to version 1.14-r10074.
Update alpine rootio-darkhttpd to version 1.14-r10073.
Update darkhttpd to version 1.15-r0.
Update darkhttpd to version 1.14-r10073.
Update rootio-darkhttpd to version 1.14-r10073.
Update darkhttpd to version 1.14-r10075.
Update rootio-darkhttpd to version 1.14-r10075.
Update unix4lyfe darkhttpd to version 1.15 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Root:Alpine:3.18	alpine	rootio-darkhttpd	< 1.14-r10074 Fix: upgrade to 1.14-r10074
Root:Alpine:3.19	alpine	rootio-darkhttpd	< 1.14-r10073 Fix: upgrade to 1.14-r10073
Alpine:v3.20	–	darkhttpd	< 1.15-r0 Fix: upgrade to 1.15-r0
Root:Alpine:3.18	–	darkhttpd	< 1.14-r10073 Fix: upgrade to 1.14-r10073
Root:Alpine:3.18	–	rootio-darkhttpd	< 1.14-r10073 Fix: upgrade to 1.14-r10073
Root:Alpine:3.19	–	darkhttpd	< 1.14-r10075 Fix: upgrade to 1.14-r10075
Root:Alpine:3.19	–	rootio-darkhttpd	< 1.14-r10075 Fix: upgrade to 1.14-r10075
–	unix4lyfe	darkhttpd	< 1.15 `cpe:2.3:a:unix4lyfe:darkhttpd::::::::`

Original advisory text

CVE-2024-23771 in darkhttpd - Patched by Root

Root has patched CVE-2024-23771 in the darkhttpd package for Root:Alpine:3.19. Multiple fixed versions available.

References

https://security.alpinelinux.org/vuln/CVE-2024-23771 Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/01/25/1 Mailing List Third Party Advisory
https://github.com/emikulic/darkhttpd/commit/f477619d49f3c4de9ad59bd194265a48ddc... Patch
https://github.com/emikulic/darkhttpd/compare/v1.14...v1.15 Product

Severity

9.8 Critical

Exploitation

1% chance of attack within 30 days

Type

CWE-203Observable Discrepancy

Timeline

Published29 Sep 2026

Updated1 Oct 2026

First seen30 Mar 2026

Sources

ROOT-OS-ALPINE-318-CVE-2024-23771 · OSV

CVE-2024-23771 · NVD

ROOT-OS-ALPINE-319-CVE-2024-23771 · OSV

ALPINE-CVE-2024-23771 · OSV

Track software like this

Free during beta