Boa is a lightweight, open-source web server that, despite its narrow product scope, occupies a prominent position in embedded and resource-constrained environments where it remains widely deployed and difficult to patch. Vulnerabilities affecting the vendor skew toward critical severity and frequently acquire public exploit code, with the exposure concentrating in core input-handling and memory-management weaknesses such as improper input validation, path traversal, SQL injection, buffer overflows, and authorization flaws that reflect the inherent risks of a C-based HTTP daemon. Defenders should prioritize inventory of Boa instances, particularly in legacy embedded appliances and IoT deployments; live exploitation activity and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Boa over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2007-4915HIGH The Intersil isl3893 extensions for Boa 0.93.15, as used on the FreeLan RO80211G-AP and other devices, do not prevent stack writes from entering memory locations used for string co | Sep 17, 2007 | 10.0 | 80 | NO | YES |
CVE-2017-9833HIGH /cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges. NOTE: multiple third parties rep | Jun 24, 2017 | 7.5 | 79 | NO | YES |
CVE-2021-33558HIGH Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, | May 27, 2021 | 7.5 | 40 | NO | YES |
CVE-2009-4496MEDIUM Boa 0.94.14rc21 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary | Jan 13, 2010 | 5.0 | 33 | NO | YES |
CVE-2022-44117CRITICAL Boa 0.94.14rc21 is vulnerable to SQL Injection via username. NOTE: the is disputed by multiple third parties because Boa does not ship with any support for SQL. | Nov 23, 2022 | 9.8 | 31 | NO | NO |
CVE-2018-21027CRITICAL Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled. | Oct 11, 2019 | 9.8 | 30 | NO | NO |
CVE-2018-21028HIGH Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function. | Oct 11, 2019 | 7.5 | 25 | NO | NO |
CVE-2016-9564HIGH Buffer overflow in send_redirect() in Boa Webserver 0.92r allows remote attackers to DoS via an HTTP GET request requesting a long URI with only '/' and '.' characters. | Nov 30, 2016 | 7.5 | 25 | NO | NO |
CVE-2000-0920MEDIUM Directory traversal vulnerability in BOA web server 0.94.8.2 and earlier allows remote attackers to read arbitrary files via a modified .. (dot dot) attack in the GET HTTP request | Dec 19, 2000 | 5.0 | 25 | NO | YES |
CVE-2022-45956MEDIUM Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD HTTP method allowing everyone to bypass the Basic Authorization mechani | Dec 12, 2022 | 5.3 | 20 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Boa.
Media articles that mention a CVE ID that affects a product developed by Boa — matched by CVE ID, not by vendor name.