CVE-2020-13432

rejetto HFS (aka HTTP File Server) v2.3m Build #300, when virtual files or folders are used, allows remote attackers to trigger an invalid-pointer write access violation via concurrent HTTP requests with a long URI or long HTTP headers.

• CWE-120

• http://hyp3rlinx.altervista.org/advisories/HFS-HTTP-FILE-SERVER-v2.3-REMOTE-BUFFER-OVERFLOW-DoS.txtExploit, Third Party Advisory
• http://packetstormsecurity.com/files/157980/HFS-Http-File-Server-2.3m-Build-300-Buffer-Overflow.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Jun/13Exploit, Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2021/Apr/12
• https://github.com/rejetto/hfs2/commit/b8ebfc4e22948e1a61506cd66e397b61ea5ea5dePatch, Third Party Advisory
• https://packetstormsecurity.com/files/157980/HFS-Http-File-Server-2.3m-Build-300-Buffer-Overflow.htmlExploit, Third Party Advisory, VDB Entry
• https://www.rejetto.com/hfs/?f=wnRelease Notes, Vendor Advisory
• http://hyp3rlinx.altervista.org/advisories/HFS-HTTP-FILE-SERVER-v2.3-REMOTE-BUFFER-OVERFLOW-DoS.txtExploit, Third Party Advisory
• http://packetstormsecurity.com/files/157980/HFS-Http-File-Server-2.3m-Build-300-Buffer-Overflow.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Jun/13Exploit, Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2021/Apr/12
• https://github.com/rejetto/hfs2/commit/b8ebfc4e22948e1a61506cd66e397b61ea5ea5dePatch, Third Party Advisory
• https://packetstormsecurity.com/files/157980/HFS-Http-File-Server-2.3m-Build-300-Buffer-Overflow.htmlExploit, Third Party Advisory, VDB Entry
• https://www.rejetto.com/hfs/?f=wnRelease Notes, Vendor Advisory

Published

Jun 8, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-13427Victor CMS 1.0 has Persistent XSS in admin/users.php?source=…6.1
• CVE-2020-13428A heap-based buffer overflow in the hxxx_AnnexB_to_xVC funct…7.8
• CVE-2020-13429legend.ts in the piechart-panel (aka Pie Chart Panel) plugin…5.4
• CVE-2020-1343An information disclosure vulnerability exists in Visual Stu…5.9
• CVE-2020-13430Grafana before 7.0.0 allows tag value XSS via the OpenTSDB d…6.1
• CVE-2020-13431I2P before 0.9.46 allows local users to gain privileges via …7.8
• CVE-2020-13433Jason2605 AdminPanel 4.0 allows SQL Injection via the editPl…9.8
• CVE-2020-13434SQLite through 3.32.0 has an integer overflow in sqlite3_str…5.5
• CVE-2020-13435SQLite through 3.32.0 has a segmentation fault in sqlite3Exp…5.5
• CVE-2020-13438ffjpeg through 2020-02-24 has an invalid read in jfif_encode…6.5
• CVE-2020-13439ffjpeg through 2020-02-24 has a heap-based buffer over-read …6.5
• CVE-2020-1344An elevation of privilege vulnerability exists in the way th…7.8