Vulnerability in Lighttpd

CVE-2012-5533

The http_request_split_value function in request.c in lighttpd before 1.4.32 allows remote attackers to cause a denial of service (infinite loop) via a request with a header containing an empty token, as demonstrated using the "Connection: TE,,Keep-Alive" header.

EPSS: 0.120 (95.7th percentile) — read the EPSS interpretation.

Affected products

  • Lighttpd — versions 1.4.31, 1.4.32
  • N/a — versions n/a

Weakness classification (CWE)

References