Vulnerability in Lighttpd

CVE-2010-0295

lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate.

EPSS: 0.121 (95.7th percentile) — read the EPSS interpretation.

Affected products

  • Lighttpd — versions 1.4.17, 1.4.24, 1.4.20
  • N/a — versions n/a

Weakness classification (CWE)

References