Description: Fix CVE-2026-68005 and possible Slowloris
 <long description that can span multiple lines, optional>
 Fixes memory exhaustion Dos in HTTP header parsing in handle_request()
Author: Alexandru Mihail <alexandru.mihail2897@gmail.com
Origin: maintainer
Forwarded: not-needed (sent by email; upstream has no public tracker)
Last-Update: 2026-09-01
---
This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
Index: mini-httpd/mini_httpd.c
===================================================================
--- mini-httpd.orig/mini_httpd.c	2026-09-01 16:28:00.700059044 +0300
+++ mini-httpd/mini_httpd.c	2026-09-01 17:39:59.007518110 +0300
@@ -159,7 +159,11 @@
 #ifndef MAX_SEND_BUFFER_SIZE
 #define MAX_SEND_BUFFER_SIZE 1048576
 #endif /* MAX_SEND_BUFFER_SIZE */
-
+/* Prevent attacker flooding headers until OOM */
+/* in start_request by using MAX_REQUEST_HEADER_BYTES*/
+#ifndef MAX_REQUEST_HEADER_BYTES
+#define MAX_REQUEST_HEADER_BYTES (64 * 1024)
+#endif /* MAX_REQUEST_HEADER_BYTES */
 
 #define METHOD_UNKNOWN 0
 #define METHOD_GET 1
@@ -1222,7 +1226,13 @@
 	    continue;
 	if ( rr <= 0 )
 	    break;
-	(void) alarm( READ_TIMEOUT );
+        /* Prevent out of memory when receiving huge headers.   */
+        /* Prevent Slowloris vector by removing alarm(60) call. */
+        /* Fixes CVE-2026-68005. */
+        if ( request_len + rr > MAX_REQUEST_HEADER_BYTES )
+	    {
+	    send_error( 431, "Request Header Fields Too Large", "", "Headers exceed maximum permitted size." );
+	    }
 	add_to_request( buf, rr );
 	if ( strstr( request, "\015\012\015\012" ) != (char*) 0 ||
 	     strstr( request, "\012\012" ) != (char*) 0 )
