CVE-2011-4362
Integer signedness error in the base64_decode function in the HTTP authentication functionality ...
Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.
Exploit likelihood
What each source reports
NVD Score used
Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.
- Record
CVE-2011-4362- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.
- Record
CVE-2011-4362- Updated
- 2026-11-02
EUVDEUVD-2011-4292 No score
Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.
- Record
EUVD-2011-4292- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wx9r-x448-8rcp No score
Integer signedness error in the base64_decode function in the HTTP authentication functionality ...
Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.
- Record
GHSA-wx9r-x448-8rcp- Updated
- 2026-11-02
OSV No score
Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.
- Record
CVE-2011-4362- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-4362 No score
Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.
- Record
DEBIAN-CVE-2011-4362- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10402-1 No score
lighttpd-1.4.37-1.6 on GA media
These are all security issues fixed in the lighttpd-1.4.37-1.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10402-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lighttpdDebian:12 |
before 1.4.30-1 | 1.4.30-1 |
lighttpdDebian:13 |
before 1.4.30-1 | 1.4.30-1 |
lighttpdDebian:14 |
before 1.4.30-1 | 1.4.30-1 |
lighttpdDebian:6.0 From an advisory covering 2 CVEs |
before 1.4.28-2+squeeze1, plus listed versions 1.4.28-2 |
1.4.28-2+squeeze1 |
lighttpdDebian:5.0 From an advisory covering 2 CVEs |
before 1.4.19-5+lenny3, plus listed versions 1.4.19-51.4.19-5+lenny11.4.19-5+lenny2 |
1.4.19-5+lenny3 |
lighttpdopenSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 1.4.37-1.6 | 1.4.37-1.6 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | lighttpd - Denial of Service (PoC) | 2011-12-31 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-4362 is a medium vulnerability (CVSS 5.0) in Lighttpd, published December 20, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 21.1%, the 97th percentile. Fixed in lighttpd 1.4.30-1.
References
secunia.com/advisories/47260
archives.neohapsis.com/archives/bugtraq/2011-12/0167.html
openwall.com/lists/oss-security/2011/11/29/8
bugzilla.redhat.com/show_bug.cgi?id=758624
debian.org/security/2011/dsa-2368
exploit-db.com/exploits/18295
Show 18 moreShow less
blog.pi3.com.pl?p=277
download.lighttpd.net/lighttpd/security/lighttpd_sa_2011_01.txt
securitytracker.com/id?1026359
exchange.xforce.ibmcloud.com/vulnerabilities/71536
redmine.lighttpd.net/issues/2370
jvn.jp/en/jp/JVN37417423/index.html
nvd.nist.gov/vuln/detail/CVE-2011-4362
github.com/advisories/GHSA-wx9r-x448-8rcp
security-tracker.debian.org/tracker/CVE-2011-4362
suse.com/security/cve/CVE-2010-0295