crates.io/static-web-server CVE-2026-27480: medium 5.3, EPSS 0.47%

Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames

Action: Upgrade static-web-server to 2.41.0 or later.

cargo update -p static-web-server --precise 2.41.0

Affected

Fixed versions

Sources

• osv: GHSA-qhp6-635j-x7r2
• https://github.com/static-web-server/static-web-server/security/advisories/GHSA-qhp6-635j-x7r2
• https://nvd.nist.gov/vuln/detail/CVE-2026-27480
• https://github.com/static-web-server/static-web-server/commit/7bf0fd425eb10dac9bf9ef5febce12c4dd039ce1
• https://github.com/static-web-server/static-web-server

CVE-2026-27480 · published 2026-02-20T18:25:27Z · modified 2026-02-23T22:58:12.472017Z · JSON