CVE-2026-75601

Published: Aug 26, 2026Modified: Aug 29, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics that disclose virtual host names, request volumes, error rates, latency distributions, and active connections. This issue is fixed in version 2.44.0.

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (3)

https://github.com/static-web-server/static-web-server/commit/a51444c81abb7d417fd931f5df58227dd04192f5

Source: security-advisories@github.com

https://github.com/static-web-server/static-web-server/security/advisories/GHSA-97q6-jph8-rxgm

Source: security-advisories@github.com

https://github.com/static-web-server/static-web-server/security/advisories/GHSA-97q6-jph8-rxgm

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.