An issue in Hugo Leisink Hiawatha version 12.1 and earlier allows a remote attacker to send a crafted HTTP request that triggers code execution on the hosting system. The attack can be performed without user interaction and could be used to gain full control over the server, compromising confidentiality, integrity, and availability.

Hiawatha web server version 12.1 or earlier is affected. The vulnerability was discovered in version 12.1 and applies to all releases up to that point. No additional vendors or product lines are listed.

The EPSS score indicates a very low probability of exploitation (<1%), and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 9.8 classifies this flaw as critical, granting attackers the ability to execute arbitrary code on the vulnerable Hiawatha web server. The attack vector is inferred to be remote HTTP-based, leveraging improper handling of request headers that permit smuggling, and requires only the ability to send a crafted HTTP request to the server.