CVE-2026-75601

Name of the Vulnerable Software and Affected Versions Static Web Server (SWS) versions prior to 2.44.0

Description Instances with both basic-auth and metrics features enabled process the '/metrics' endpoint before the basic-auth check in src/handler.rs. This allows an unauthenticated remote attacker to retrieve Prometheus metrics, which disclose virtual host names, request volumes, error rates, latency distributions, and active connections.

Recommendations Update to version 2.44.0. As a temporary workaround, disable the metrics feature or the basic-auth feature to prevent the unauthorized retrieval of metrics via the '/metrics' endpoint.