CVE-2021-43298

9.8 criticalEPSS 2.3%

Critical (9.8) in embedthis goahead. EPSS 2.3% chance of exploitation in the next 30 days.

The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte-by-byte, by recording the webserver's response time until the unauthorized (401) response.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.3% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
CWEs: CWE-307, CWE-208
Published: 2022-01-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

embedthis:goahead

References

https://github.com/embedthis/goahead/issues/304
https://github.com/embedthis/goahead/issues/304

Check your stack JSON