https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-06T13:18:48.060304+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-75601 CVE-2026-75601 — Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled 2026-10-06T13:18:48.061504+00:00

Affected: static-web-server

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics that disclose virtual host names, request volumes, error rates, latency distributions, and active connections. This issue is fixed in version 2.44.0.