A denial of service vulnerability in ACME mini_httpd allows unauthenticated remote attackers to crash the service via malformed HTTP request headers.

This vulnerability occurs due to improper input handling in the handle_request function. An unauthenticated remote attacker can trigger a denial of service state by sending specifically crafted HTTP request headers that the parser cannot process correctly.

The vulnerability has a CVSS score of 7.5, which indicates a high risk to service availability. Successful exploitation results in the service crashing, which can cause significant downtime for any systems relying on the mini_httpd web server, leading to operational disruption.

Immediate Action: Upgrade to version 1.30 or later to ensure the header parsing logic is corrected.

Proactive Monitoring: Monitor service logs and system stability for repeated crashes or unexpected termination of the mini_httpd process.

Compensating Controls: Use a Web Application Firewall (WAF) to filter and block malformed HTTP requests before they reach the web server.

Public Exploit Available: Yes, a public proof-of-concept exists via the linked GitHub repository.

Given the availability of a public proof-of-concept and the ease of triggering a denial of service, administrators must patch affected systems to version 1.30 or later immediately. Failure to update leaves infrastructure vulnerable to simple, automated disruption attempts.