CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

www/darkhttpd 1.16

Simple, static web server

Port info

Maintainer
henrichhartzer@tuta.io
Packages
latest: 1.16
Upstream
Higher version available: 1.17
Last update
to 1.16 · b465f9a06a
Quarterly
2026Q4: 1.16
WWW
https://unix4lyfe.org/darkhttpd/
Links
cgit · VuXML

Install

Package
# pkg install darkhttpd
installs 1.16 from latest; from quarterly (2026Q4) 1.16
Port
# cd /usr/ports/www/darkhttpd && make install clean
Size
21 KiB download · 44 KiB installed
Depends on
nothing
License
ISCL
Creates
user darkhttpd, group darkhttpd

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.161.16–
FreeBSD 151.161.16–
FreeBSD 141.161.161.16

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.161.16–
FreeBSD 141.161.161.16

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 1.16.

Fixed (1)

Show 1 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (9)

Bernhard Froehlich (decke) · 1.16
www/darkhttpd: Fix CPE_VENDOR data
b465f9a06a
Joel Bodenmann (jbo) · 1.16
www/darkhttpd: Update to 1.16

Changelogs:
  - 1.16: https://github.com/emikulic/darkhttpd/releases/tag/v1.16
  - 1.15: https://github.com/emikulic/darkhttpd/releases/tag/v1.15

PR:		277386
MFH:		2024Q1
Approved by:	tcberner (mentor, implicit)
564aedad9a
Fernando Apesteguía (fernape) · 1.14
www/darkhttpd: Update to 1.14 (Fixes CVE-2020-25691)

ChangeLog: https://github.com/emikulic/darkhttpd/releases/tag/v1.14

 * Add support for logging with syslog.
 * Fix hung connection from consecutive keep-alive requests.
 * Fix high CPU usage when timeout is disabled.
 * Add --forward-https.
 * Make header parsing case insensitive, to work behind an HTTP2 reverse proxy.
 * Add trailing slash to links for directories.
 * Fix crash when a file has a large (year 10,000+) mtime.

A flaw was found in darkhttpd. Invalid error handling allows remote attackers
to cause denial-of-service by accessing a file with a large modification date.
The highest threat from this vulnerability is to system availability.

PR:		267507
Reported by:	henrichhartzer@tuta.io
MFH:		2022Q4 (security update)
Security:	CVE-2020-25691
1de880e0f6
Fernando Apesteguía (fernape) · 1.13_1
www/darkhttpd: add rc script

PR:		266239
Reported by:	DtxdF@disroot.org
Approved by:	henrichartzer@tuta.io (maintainer, timeout > 1 month)
9884951c50
Stefan Eßer (se) · 1.13
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 1.13
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Bernhard Froehlich (decke) · 1.13
www/darkhttpd: Add CPE information, pet porlint warning

Approved by:	portmgr (blanket)
b11734a3db
Fernando Apesteguía (fernape) · 1.13
www/darkhttpd: Fix NO_INSTALL

This port actually install things...

Reported by:	danfe@
088f0b29ee
Fernando Apesteguía (fernape) · 1.13
www/darkhttpd: Add new port

Simple static http web server.
When you need a web server in a hurry.

PR:	262234
Reported by:	henrichhartzer@tuta.io
Reviewed by:	diizzy@
76aee1b05b