CVE-2025-12642 | Critical | 9.1 | 2025-11-03 | lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attac… |
CVE-2018-25103 | Medium | 5.3 | 2024-06-17 | There exists use-after-free vulnerabilities in lighttpd <= 1.4.50 request parsing which might read from invalid pointers to memory used in the same request, no… |
CVE-2022-41556 | High | 7.5 | 2022-10-06 | A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomal… |
CVE-2022-37797 | High | 7.5 | 2022-09-12 | In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null… |
CVE-2022-30780 | High | 7.5 | 2022-06-11 | Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_mo… |
CVE-2022-22707 | Medium | 5.9 | 2022-01-06 | In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based buffer overflow (4 bytes representing -… |
CVE-2019-11072 | Critical | 9.8 | 2019-04-10 | lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unsp… |
CVE-2018-19052 | High | 7.5 | 2018-11-07 | An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory abo… |
CVE-2015-3200 | High | 7.5 | 2015-06-09 | mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as… |
CVE-2014-2324 | | | 2014-03-14 | Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary file… |
CVE-2014-2323 | Critical | 9.8 | 2014-03-14 | SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related… |
CVE-2013-4560 | | | 2013-11-20 | Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vect… |
CVE-2013-4559 | | | 2013-11-20 | lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if… |
CVE-2013-4508 | High | 7.5 | 2013-11-08 | lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets in… |
CVE-2013-1427 | | | 2013-03-21 | The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which… |
CVE-2012-5533 | | | 2012-11-24 | The http_request_split_value function in request.c in lighttpd before 1.4.32 allows remote attackers to cause a denial of service (infinite loop) via a request… |
CVE-2011-4362 | | | 2011-12-24 | Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN… |
CVE-2010-0295 | | | 2010-02-03 | lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of ser… |
CVE-2008-4360 | | | 2008-10-03 | mod_userdir in lighttpd before 1.4.20, when a case-insensitive operating system or filesystem is used, performs case-sensitive comparisons on filename componen… |
CVE-2008-4359 | | | 2008-10-03 | lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might… |
CVE-2008-4298 | | | 2008-09-27 | Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service (memory consumption)… |
CVE-2008-1531 | | | 2008-03-27 | The connection_state_machine function (connections.c) in lighttpd 1.4.19 and earlier, and 1.5.x before 1.5.0, allows remote attackers to cause a denial of serv… |
CVE-2008-1270 | | | 2008-03-10 | mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files… |
CVE-2008-1111 | | | 2008-03-04 | mod_cgi in lighttpd 1.4.18 sends the source code of CGI scripts instead of a 500 error when a fork failure occurs, which might allow remote attackers to obtain… |
CVE-2008-0983 | | | 2008-02-26 | lighttpd 1.4.18, and possibly other versions before 1.5.0, does not properly calculate the size of a file descriptor array, which allows remote attackers to ca… |
CVE-2007-4727 | | | 2007-09-12 | Buffer overflow in the fcgi_env_add function in mod_proxy_backend_fastcgi.c in the mod_fastcgi extension in lighttpd before 1.4.18 allows remote attackers to o… |
CVE-2007-3950 | | | 2007-07-24 | lighttpd 1.4.15, when run on 32 bit platforms, allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors involving the use of… |
CVE-2007-3949 | | | 2007-07-24 | mod_access.c in lighttpd 1.4.15 ignores trailing / (slash) characters in the URL, which allows remote attackers to bypass url.access-deny settings. |
CVE-2007-3948 | | | 2007-07-24 | connections.c in lighttpd before 1.4.16 might accept more connections than the configured maximum, which allows remote attackers to cause a denial of service (… |
CVE-2007-3947 | | | 2007-07-24 | request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service (daemon crash) by sending an HTTP request with duplicate headers, as demonstr… |
CVE-2007-3946 | | | 2007-07-24 | mod_auth (http_auth.c) in lighttpd before 1.4.16 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors involving (1) a me… |
CVE-2007-1870 | | | 2007-04-18 | lighttpd before 1.4.14 allows attackers to cause a denial of service (crash) via a request to a file whose mtime is 0, which results in a NULL pointer derefere… |
CVE-2007-1869 | | | 2007-04-18 | lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource consumption) by disconnecting while lighttpd is parsing CRLF… |
CVE-2006-0814 | | | 2006-03-06 | response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via requests that cont… |
CVE-2006-0760 | | | 2006-02-18 | LightTPD 1.4.8 and earlier, when the web root is on a case-insensitive filesystem, allows remote attackers to bypass URL checks and obtain sensitive informatio… |
CVE-2005-0453 | | | 2005-02-16 | The buffer_urldecode function in Lighttpd 1.3.7 and earlier does not properly handle control characters, which allows remote attackers to obtain the source cod… |