An issue exists in ACME mini_httpd 1.30 and earlier that allows a remote attacker to trigger a denial of service by exploiting weaknesses in the HTTP request header parser within the handle_request() function. The vulnerability stems from improper handling of malformed or oversized headers, leading to unbounded resource consumption and eventual crash or crash loops. The weakness aligns with CWE-674, where the software fails to control resource use, exposing the server to interruption of service.

The affected vendor is ACME and the product is mini_httpd. Versions 1.30 and all earlier releases are vulnerable. No additional vendor or product variations are listed.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 7.5, indicating a high severity, but the description indicates that the remote attacker can trigger a service outage by sending crafted HTTP headers. Likely attack vector is via network traffic to the HTTP port, with no special authentication or privilege required. Because the flaw is in the header parsing routine, any machine exposed to public or untrusted traffic could be impacted.