CVE-2010-0295
lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a...
lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate.
Exploit likelihood
What each source reports
NVD Score used
lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate.
- Record
CVE-2010-0295- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate.
- Record
CVE-2010-0295- Updated
- 2026-11-02
EUVDEUVD-2010-0326 No score
lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate.
- Record
EUVD-2010-0326- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x8r6-c7pf-w6m4 No score
lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a...
lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate.
- Record
GHSA-x8r6-c7pf-w6m4- Updated
- 2026-11-02
OSV No score
lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate.
- Record
CVE-2010-0295- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-0295 No score
lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate.
- Record
DEBIAN-CVE-2010-0295- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10402-1 No score
lighttpd-1.4.37-1.6 on GA media
These are all security issues fixed in the lighttpd-1.4.37-1.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10402-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lighttpdDebian:12 |
before 1.4.26-1 | 1.4.26-1 |
lighttpdDebian:13 |
before 1.4.26-1 | 1.4.26-1 |
lighttpdDebian:14 |
before 1.4.26-1 | 1.4.26-1 |
lighttpdDebian:4.0 |
before 1.4.13-4etch12, plus listed versions 1.4.13-41.4.13-4etch11.4.13-4etch101.4.13-4etch111.4.13-4etch2 Show 7 moreShow less1.4.13-4etch31.4.13-4etch41.4.13-4etch51.4.13-4etch61.4.13-4etch71.4.13-4etch81.4.13-4etch9 |
1.4.13-4etch12 |
lighttpdDebian:5.0 |
before 1.4.19-5+lenny1, plus listed versions 1.4.19-5 |
1.4.19-5+lenny1 |
lighttpdopenSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 1.4.37-1.6 | 1.4.37-1.6 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | lighttpd 1.4/1.5 - Slow Request Handling Remote Denial of Service | 2010-02-02 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-0295 is a medium vulnerability (CVSS 5.0) in Lighttpd, published February 2, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 12.1%, the 96th percentile. Fixed in lighttpd 1.4.26-1.
References
secunia.com/advisories/38403
redmine.lighttpd.net/projects/lighttpd/repository/revisions/2711
vupen.com/english/advisories/2011/0172
download.lighttpd.net/lighttpd/security/lighttpd_sa_2010_01.txt
Show 24 moreShow less
lists.fedoraproject.org/pipermail/package-announce/2010-May/041307.html
exchange.xforce.ibmcloud.com/vulnerabilities/56038
blogs.sun.com/security/entry/cve_2010_0295_vulnerability_in
debian.org/security/2010/dsa-1987
lists.opensuse.org/opensuse-security-announce/2010-02/msg00003.html
securityfocus.com/bid/38036
openwall.com/lists/oss-security/2010/02/01/8
security.gentoo.org/glsa/glsa-201006-17.xml
nvd.nist.gov/vuln/detail/CVE-2010-0295
github.com/advisories/GHSA-x8r6-c7pf-w6m4
security-tracker.debian.org/tracker/CVE-2010-0295
suse.com/security/cve/CVE-2010-0295