{"action":"Upgrade static-web-server to 2.41.0 or later.","affected":[{"fixed":"2.41.0","introduced":"2.1.0"}],"component":"static-web-server","cve_ids":["CVE-2026-27480"],"ecosystem":"crates.io","epss":0.00475,"exploited":false,"fixed_versions":["2.41.0"],"ghsa_id":"GHSA-qhp6-635j-x7r2","id":"tcs_01M5KF2KVFN1GFAPH846XTNE10","modified_at":"2026-02-23T22:58:12.472017Z","published_at":"2026-02-20T18:25:27Z","references":["https://osv.dev/vulnerability/GHSA-qhp6-635j-x7r2","https://github.com/static-web-server/static-web-server/security/advisories/GHSA-qhp6-635j-x7r2","https://nvd.nist.gov/vuln/detail/CVE-2026-27480","https://github.com/static-web-server/static-web-server/commit/7bf0fd425eb10dac9bf9ef5febce12c4dd039ce1","https://github.com/static-web-server/static-web-server"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-qhp6-635j-x7r2","url":"https://osv.dev/vulnerability/GHSA-qhp6-635j-x7r2"}],"summary":"Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames"}