CVE-2025-12642
HTTP Header Smuggling via Trailer Merge
lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks.
Successful exploitation may allow an attacker to:
- Bypass access control rules
- Inject unsafe input into backend logic that trusts request headers
- Execute HTTP Request Smuggling attacks under some conditions
This issue affects lighttpd1.4.80
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
HTTP Header Smuggling via Trailer Merge
lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks.
Successful exploitation may allow an attacker to:
- Bypass access control rules
- Inject unsafe input into backend logic that trusts request headers
- Execute HTTP Request Smuggling attacks under some conditions
This issue affects lighttpd1.4.80
- Record
CVE-2025-12642- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-444
- Updated
- 2026-11-02
EUVDEUVD-2025-37517
lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks.
Successful exploitation may allow an attacker to:
- Bypass access control rules
- Inject unsafe input into backend logic that trusts request headers
- Execute HTTP Request Smuggling attacks under some conditions
This issue affects lighttpd1.4.80
- Record
EUVD-2025-37517- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fvx8-q97q-cw73
lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This...
lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks.
Successful exploitation may allow an attacker to:
- Bypass access control rules
- Inject unsafe input into backend logic that trusts request headers
- Execute HTTP Request Smuggling attacks under some conditions
This issue affects lighttpd1.4.80
- Record
GHSA-fvx8-q97q-cw73- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
NVD
lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks.
Successful exploitation may allow an attacker to:
- Bypass access control rules
- Inject unsafe input into backend logic that trusts request headers
- Execute HTTP Request Smuggling attacks under some conditions
This issue affects lighttpd1.4.80
- Record
CVE-2025-12642- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
OSV
lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks.
Successful exploitation may allow an attacker to:
- Bypass access control rules
- Inject unsafe input into backend logic that trusts request headers
- Execute HTTP Request Smuggling attacks under some conditions
This issue affects lighttpd1.4.80
- Record
CVE-2025-12642- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-12642
lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: * Bypass access control rules * Inject unsafe input into backend logic that trusts request headers * Execute HTTP Request Smuggling attacks under some conditions This issue affects lighttpd1.4.80
- Record
UBUNTU-CVE-2025-12642- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lighttpdUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.4.31-3ubuntu31.4.33-1ubuntu11.4.33-1+nmu2ubuntu11.4.33-1+nmu2ubuntu21.4.33-1+nmu2ubuntu2.11.4.33-1+nmu2ubuntu2.1+esm1 |
None known |
lighttpdUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.4.35-4ubuntu11.4.35-4ubuntu21.4.35-4ubuntu2.11.4.35-4ubuntu2.1+esm1 |
None known |
lighttpdUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.4.45-1ubuntu11.4.45-1ubuntu31.4.45-1ubuntu3+esm11.4.45-1ubuntu3.18.041.4.45-1ubuntu3.18.04+esm11.4.45-1ubuntu3.18.04.11.4.45-1ubuntu3.18.04.1+esm1 |
None known |
lighttpdUbuntu:20.04:LTS |
All versions, plus listed versions 1.4.53-4ubuntu21.4.54-2ubuntu11.4.55-1ubuntu11.4.55-1ubuntu1.20.04.11.4.55-1ubuntu1.20.04.2 |
None known |
lighttpdUbuntu:22.04:LTS |
All versions, plus listed versions 1.4.59-1ubuntu21.4.59-1ubuntu31.4.63-1ubuntu11.4.63-1ubuntu21.4.63-1ubuntu31.4.63-1ubuntu3.1 |
None known |
lighttpdUbuntu:24.04:LTS |
All versions, plus listed versions 1.4.69-1ubuntu11.4.69-1ubuntu21.4.73-1ubuntu11.4.73-1ubuntu21.4.74-1ubuntu21.4.74-1ubuntu3 |
None known |
lighttpdUbuntu:25.10 |
All versions, plus listed versions 1.4.79-1ubuntu11.4.79-2ubuntu11.4.82-2ubuntu1 |
None known |
lighttpdUbuntu:26.10 |
All versions, plus listed versions 1.4.82-2ubuntu21.4.84-1ubuntu31.4.85-1ubuntu2 |
None known |
lighttpdUbuntu:26.04:LTS |
All versions, plus listed versions 1.4.82-2ubuntu11.4.82-2ubuntu2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-12642 is a medium vulnerability (CVSS 6.9) in Lighttpd, published November 3, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. No source names a fixed version.