T3Pp31

**Name of the Vulnerable Software and Affected Versions** Static Web Server (SWS) versions prior to 2.44.0 **Description** Instances with both basic-auth and metrics features enabled process the '/metrics' endpoint before the basic-auth check in `src/handler.rs`. This allows an unauthenticated remote attacker to retrieve Prometheus metrics, which disclose virtual host names, request volumes, error rates, latency distributions, and active connections. **Recommendations** Update to version 2.44.0. As a temporary workaround, disable the metrics feature or the basic-auth feature to prevent the unauthorized retrieval of metrics via the '/metrics' endpoint.