PT-2025-12854 · Atophttpd · Atophttpd

Published 2025-03-26 · Updated 2025-03-26 · CVE-2025-30742

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions atophttpd version 2.8.0

Description The issue is caused by an off-by-one error in httpd.c, resulting in an out-of-bounds read. This occurs when a 1024-character req string is processed without a final '0' character.

Recommendations For atophttpd version 2.8.0, consider updating to a newer version that addresses this issue, as the current version has a known off-by-one error and resultant out-of-bounds read. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-193

Related Identifiers

CVE-2025-30742

Affected Products

Atophttpd

References · 12

• https://osv.dev/vulnerability/CVE-2025-30742 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30742 · Security Note
• https://github.com/pizhenwei/atophttpd/blob/74c9f14796b15dc9de5839a5749202f933937a9c/httpd.c#L376-L381 · Note
• https://github.com/pizhenwei/atophttpd/blob/74c9f14796b15dc9de5839a5749202f933937a9c/httpd.c#L71-L72 · Note
• https://github.com/pizhenwei/atophttpd/blob/74c9f14796b15dc9de5839a5749202f933937a9c/httpd.c#L492-L496 · Note
• https://github.com/pizhenwei/atophttpd/blob/74c9f14796b15dc9de5839a5749202f933937a9c/httpd.c#L376-L399 · Note
• https://twitter.com/CVEnew/status/1904755929431892000 · Twitter Post
• https://t.me/cvenotify/116269 · Telegram Post
• https://t.me/cvedetector/21147 · Telegram Post
• https://t.me/cvetracker/19932 · Telegram Post
• https://t.me/cvenotify/116273 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1904752916377809031 · Twitter Post