Every CVESearch/Get API key

CVE-2008-4298

Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows...

5.0 MediumFix available

CVE-2008-4298 is a medium vulnerability (CVSS 5.0) in Lighttpd, published September 27, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.53%, the 89th percentile. Fixed in lighttpd 1.4.19-5.

What does this mean?
Severity
5.0 MediumCVSS 2.0, NVD
Exploit chance
3.53%EPSS, 89th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1.4.19-5lighttpd +3 more

Description

Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests with duplicate request headers.

Exploit likelihood

3.53%Down 0.8 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
lighttpd
Debian:12
before 1.4.19-5
1.4.19-5
lighttpd
Debian:13
before 1.4.19-5
1.4.19-5
lighttpd
Debian:14
before 1.4.19-5
1.4.19-5
lighttpd
Debian:4.0
From an advisory covering 3 CVEs
before 1.4.13-4etch11, plus listed versions
1.4.13-41.4.13-4etch11.4.13-4etch101.4.13-4etch21.4.13-4etch3
Show 6 moreShow less
1.4.13-4etch41.4.13-4etch51.4.13-4etch61.4.13-4etch71.4.13-4etch81.4.13-4etch9
1.4.13-4etch11

What each source reports

NVD Score used5.0

Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests with duplicate request headers.

Record
CVE-2008-4298
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-399
Updated
2026-11-02
CVE ListNo score

Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests with duplicate request headers.

Record
CVE-2008-4298
Updated
2026-11-02
EUVDEUVD-2008-4281No score

Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests with duplicate request headers.

Record
EUVD-2008-4281
Updated
2026-11-03
GitHub AdvisoriesGHSA-w6pj-53xr-3hq6No score

Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows...

Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests with duplicate request headers.

Record
GHSA-w6pj-53xr-3hq6
Updated
2026-11-02
OSVNo score

Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests with duplicate request headers.

Record
CVE-2008-4298
Updated
2026-11-02
OSVDEBIAN-CVE-2008-4298No score

Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests with duplicate request headers.

Record
DEBIAN-CVE-2008-4298
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 16 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open