crates.io static-web-server vulnerabilities

Latest crates.io static-web-server CVEs

Newest publication first

1. CVE-2026-27480 Static Web Server: Timing-Based Username Enumeration in Basic Authentication

   Published 2026-02-21

   Medium·CVSS 5.3 EPSS 0.39%

   Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. In versions 2.1.0 through 2.40.1, a timing-based username enumeration vulnerability in Basic Authentication allows attackers to identify valid users by exploiting early responses for...

2. CVE-2025-67487 Static Web Server is vulnerable to symbolic link Path Traversal

   Published 2025-12-09

   Medium·CVSS 5.5 EPSS 0.44%

   Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Versions 2.40.0 and below contain symbolic links (symlinks) which can be used to access files or directories outside the intended web root folder. SWS generally does not prevent syml...

3. CVE-2024-32966 Stored Cross-site Scripting in directory listings via file names in static-web-server

   Published 2024-05-01

   Medium·CVSS 5.8 EPSS 0.37%

   Static Web Server (SWS) is a tiny and fast production-ready web server suitable to serve static web files or assets. In affected versions if directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like <img src=x oner...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.