CVE-2007-1869
lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource...
lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource consumption) by disconnecting while lighttpd is parsing CRLF sequences, which triggers an infinite loop and file descriptor consumption.
Exploit likelihood
What each source reports
NVD Score used
lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource consumption) by disconnecting while lighttpd is parsing CRLF sequences, which triggers an infinite loop and file descriptor consumption.
- Record
CVE-2007-1869- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource consumption) by disconnecting while lighttpd is parsing CRLF sequences, which triggers an infinite loop and file descriptor consumption.
- Record
CVE-2007-1869- Updated
- 2026-11-02
EUVDEUVD-2007-1863 No score
lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource consumption) by disconnecting while lighttpd is parsing CRLF sequences, which triggers an infinite loop and file descriptor consumption.
- Record
EUVD-2007-1863- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7mcc-f855-qrgf No score
lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource...
lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource consumption) by disconnecting while lighttpd is parsing CRLF sequences, which triggers an infinite loop and file descriptor consumption.
- Record
GHSA-7mcc-f855-qrgf- Updated
- 2026-11-02
OSV No score
lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource consumption) by disconnecting while lighttpd is parsing CRLF sequences, which triggers an infinite loop and file descriptor consumption.
- Record
CVE-2007-1869- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-1869 No score
lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource consumption) by disconnecting while lighttpd is parsing CRLF sequences, which triggers an infinite loop and file descriptor consumption.
- Record
DEBIAN-CVE-2007-1869- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10585-1 No score
lighttpd-1.4.59-2.1 on GA media
These are all security issues fixed in the lighttpd-1.4.59-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10585-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lighttpdDebian:12 |
before 1.4.15-1 | 1.4.15-1 |
lighttpdDebian:13 |
before 1.4.15-1 | 1.4.15-1 |
lighttpdDebian:14 |
before 1.4.15-1 | 1.4.15-1 |
lighttpdDebian:4.0 From an advisory covering 2 CVEs |
before 1.4.13-4etch1, plus listed versions 1.4.13-4 |
1.4.13-4etch1 |
lighttpdopenSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 1.4.59-2.1 | 1.4.59-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| aliases | ||
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-1869 is a medium vulnerability (CVSS 5.0) in Lighttpd, published April 18, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.38%, the 88th percentile. Fixed in lighttpd 1.4.15-1.
References
secunia.com/advisories/25613
security.gentoo.org/glsa/glsa-200705-07.xml
vupen.com/english/advisories/2007/1399
novell.com/linux/security/advisories/2007_007_suse.html
exchange.xforce.ibmcloud.com/vulnerabilities/33671
Show 19 moreShow less
issues.rpath.com/browse/RPL-1218
debian.org/security/2007/dsa-1303
securityfocus.com/bid/23515
lighttpd.net/assets/2007/4/13/lighttpd_sa2007_01.txt
nvd.nist.gov/vuln/detail/CVE-2007-1869
github.com/advisories/GHSA-7mcc-f855-qrgf
security-tracker.debian.org/tracker/CVE-2007-1869
suse.com/security/cve/CVE-2007-1869