CVE-2016-1000212

lighttpd - security update

No scoreFix available

Dominic Scheirlinck and Scott Geary of Vend reported an insecure behaviour in the lighttpd web server. Lighttpd assigned Proxy header values from client requests to internal HTTP_PROXY environment variables. This could be used to carry out Man in the Middle Attacks (MIDM) or create connections to arbitrary hosts (CVE-2016-1000212).

What each source reports

OSVMGASA-2016-0398 No score

Updated lighttpd packages fix security vulnerability

Record: MGASA-2016-0398
Updated: 2026-11-02

OSVSUSE-SU-2017:0728-1 No score

Security update for lighttpd

This update for lighttpd fixes the following issues:

Security issues fixed:

CVE-2016-1000212: don't allow requests to set the HTTP_PROXY variable. As *CGI apps might pick it up and use it for outgoing requests (bsc#990847).
CVE-2015-3200: log injection via malformed base64 string in Authentication header (bsc#932286).

Bugfixes:

added su directive to logrotate file as the directory is owned by lighttpd. (bsc#981347)
fix out of bounds read in mod_scgi (debian#857255)

Record: SUSE-SU-2017:0728-1
Updated: 2026-11-02

OSVSUSE-SU-2017:0731-1 No score

Security update for lighttpd

This update for lighttpd fixes the following issues:

Security issues fixed:

CVE-2016-1000212: Don't allow requests to set the HTTP_PROXY variable. As *CGI apps might pick it up and use it for outgoing requests. (bsc#990847)
CVE-2015-3200: Log injection via malformed base64 string in Authentication header. (bsc#932286)

Bug fixes:

Add su directive to logrotate file as the directory is owned by lighttpd. (bsc#981347)
Fix out of bounds read in mod_scgi.

Record: SUSE-SU-2017:0731-1
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-1000212 No score

Mitigation for HTTPoxy vulnerability

Record: UBUNTU-CVE-2016-1000212
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`lighttpd` Debian:12	before 1.4.43-1	1.4.43-1
`lighttpd` Debian:13	before 1.4.43-1	1.4.43-1
`lighttpd` Debian:14	before 1.4.43-1	1.4.43-1
`lighttpd` Debian:7	before 1.4.31-4+deb7u5, plus listed versions 1.4.31-41.4.31-4+deb7u11.4.31-4+deb7u21.4.31-4+deb7u31.4.31-4+deb7u4	1.4.31-4+deb7u5
`lighttpd` Debian:8	before 1.4.35-4+deb8u1, plus listed versions 1.4.35-4	1.4.35-4+deb8u1
`lighttpd` Mageia:5	before 1.4.37-1.1.mga5	1.4.37-1.1.mga5
`lighttpd` SUSE:Linux Enterprise High Availability Extension 12 SP1 From an advisory covering 2 CVEs	before 1.4.35-3.1	1.4.35-3.1
`lighttpd` SUSE:Linux Enterprise High Availability Extension 12 SP2 From an advisory covering 2 CVEs	before 1.4.35-3.1	1.4.35-3.1
`lighttpd` SUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 2 CVEs	before 1.4.35-3.1	1.4.35-3.1
`lighttpd` SUSE:Linux Enterprise Software Development Kit 11 SP4 From an advisory covering 2 CVEs	before 1.4.20-2.58.1	1.4.20-2.58.1

Show 4 moreShow less

Affected packages
Package	Affected	Fixed
`lighttpd` SUSE:Linux Enterprise High Availability Extension 11 SP4 From an advisory covering 2 CVEs	before 1.4.20-2.58.1	1.4.20-2.58.1
`lighttpd` SUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 2 CVEs	before 1.4.20-2.58.1	1.4.20-2.58.1
`lighttpd` Ubuntu:14.04:LTS	before 1.4.33-1+nmu2ubuntu2.1, plus listed versions 1.4.31-3ubuntu31.4.33-1ubuntu11.4.33-1+nmu2ubuntu11.4.33-1+nmu2ubuntu2	1.4.33-1+nmu2ubuntu2.1
`lighttpd` Ubuntu:16.04:LTS	before 1.4.35-4ubuntu2.1, plus listed versions 1.4.35-4ubuntu11.4.35-4ubuntu2	1.4.35-4ubuntu2.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-1000212 is a vulnerability with no CVSS score yet in lighttpd, published January 1, 0001. No source lists public exploit code. Fixed in lighttpd 1.4.43-1.

References

Show 8 moreShow less