Version 3.2.0b4-011302 of htdig does not appear to be vulnerable. (It is the lastest version that is provided by redhat but does not appear on sourceforge: http://sourceforge.net/project/showfiles.php?group_id=4593 ) Howard: which version of htdig did you test this against?