Sergey Lyubka maintains a small set of lightweight HTTP server projects, including Mongoose and Simple HTTPD, that appear in embedded and resource-constrained deployments. The recurring vulnerability signals cluster around web-server input handling and file-access boundaries, particularly path-traversal and improper input-validation flaws alongside instances of sensitive information exposure, which are characteristic weaknesses in minimal HTTP implementations. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Sergey Lyubka over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2006-5216HIGH Stack-based buffer overflow in Sergey Lyubka Simple HTTPD (shttpd) 1.34 allows remote attackers to execute arbitrary code via a long URI. | Oct 10, 2006 | 7.5 | 71 | NO | YES |
CVE-2007-3407MEDIUM Sergey Lyubka Simple HTTPD (shttpd) 1.38 allows remote attackers to obtain sensitive information (script source code) via a URL with a trailing encoded space (%20). | Jun 26, 2007 | 5.0 | 27 | NO | YES |
CVE-2007-6326MEDIUM Sergey Lyubka Simple HTTPD (shttpd) 1.3 on Windows allows remote attackers to cause a denial of service via a request that includes an MS-DOS device name, as demonstrated by the /a | Dec 13, 2007 | 5.0 | 25 | NO | YES |
CVE-2009-1354MEDIUM Directory traversal vulnerability in Mongoose 2.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI. | Apr 21, 2009 | 4.0 | 22 | NO | YES |
CVE-2009-4530MEDIUM Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending ::$DATA to the URI. | Dec 31, 2009 | 5.0 | 15 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Sergey Lyubka.
Media articles that mention a CVE ID that affects a product developed by Sergey Lyubka — matched by CVE ID, not by vendor name.