Lighttpd vulnerabilities

Products

• Lighttpd 36

Newest

• lighttpd HTTP Header Smuggling via Trailer Merge CVE-2025-12642 6.9 MediumNovember 3, 2025
• lighttpd Use-after-free vulnerabilities in lighttpd <= 1.4.50 CVE-2018-25103 Fix available 5.3 MediumJune 17, 2024
• lighttpd, fedoraproject fedora +1 more A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of... CVE-2022-41556 Fix available 7.5 HighSeptember 28, 2022
• lighttpd, debian linux +1 more In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid... CVE-2022-37797 Fix available 7.5 HighSeptember 12, 2022
• lighttpd Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU... CVE-2022-30780 Public exploitFix available EPSS 57.2% 7.5 HighJune 11, 2022
• lighttpd, debian linux +1 more In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward... CVE-2022-22707 Fix available 5.9 MediumJanuary 6, 2022
• lighttpd ** DISPUTED ** lighttpd before 1.4.54 has a signed integer overflow, which might allow remote... CVE-2019-11072 Fix availableDisputed EPSS 73.8% 9.8 CriticalApril 10, 2019
• lighttpd, debian linux, opensuse backports sle +2 more +4 more An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50.... CVE-2018-19052 Public exploitFix available EPSS 13.7% 7.5 HighNovember 7, 2018
• lighttpd, hp virtual customer access system, oracle solaris +2 more mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a... CVE-2015-3200 Fix available 7.5 HighJune 9, 2015
• lighttpd, contec sv-cpt-mc310 firmware, debian linux +3 more +5 more Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in... CVE-2014-2324 Public exploitFix available EPSS 29.5% 5.0 MediumMarch 12, 2014
• lighttpd, debian linux, opensuse +2 more +4 more SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote... CVE-2014-2323 Public exploitFix available EPSS 62.8% 9.8 CriticalMarch 12, 2014
• lighttpd, debian linux, opensuse +2 more Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial... CVE-2013-4560 Fix available 5.0 MediumNovember 13, 2013
• lighttpd, debian linux, opensuse +2 more lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3)... CVE-2013-4559 Fix available EPSS 10.7% 7.6 HighNovember 13, 2013
• lighttpd, debian linux, opensuse +2 more lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier... CVE-2013-4508 Fix available 7.5 HighNovember 8, 2013
• lighttpd The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux... CVE-2013-1427 Fix available 1.9 LowMarch 15, 2013
• lighttpd The http_request_split_value function in request.c in lighttpd before 1.4.32 allows remote... CVE-2012-5533 Public exploitFix available EPSS 12.0% 5.0 MediumNovember 24, 2012
• lighttpd, debian linux +1 more Integer signedness error in the base64_decode function in the HTTP authentication functionality ... CVE-2011-4362 Public exploitFix available EPSS 21.1% 5.0 MediumDecember 20, 2011
• lighttpd lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a... CVE-2010-0295 Public exploitFix available EPSS 12.1% 5.0 MediumFebruary 2, 2010
• lighttpd, debian linux +1 more mod_userdir in lighttpd before 1.4.20, when a case-insensitive operating system or filesystem is... CVE-2008-4360 Fix available 7.5 HighOctober 3, 2008
• lighttpd, debian linux +1 more lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite... CVE-2008-4359 Fix available 7.5 HighOctober 3, 2008
• lighttpd Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows... CVE-2008-4298 Fix available 5.0 MediumSeptember 27, 2008
• lighttpd, debian linux +1 more The connection_state_machine function (connections.c) in lighttpd 1.4.19 and earlier, and 1.5.x... CVE-2008-1531 Fix available 4.3 MediumMarch 27, 2008
• lighttpd mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME... CVE-2008-1270 Public exploitFix available EPSS 11.9% 5.0 MediumMarch 10, 2008
• lighttpd mod_cgi in lighttpd 1.4.18 sends the source code of CGI scripts instead of a 500 error when a... CVE-2008-1111 Fix available 5.0 MediumMarch 4, 2008
• lighttpd lighttpd 1.4.18, and possibly other versions before 1.5.0, does not properly calculate the size... CVE-2008-0983 Fix available 5.0 MediumFebruary 26, 2008
• lighttpd Buffer overflow in the fcgi_env_add function in mod_proxy_backend_fastcgi.c in the mod_fastcgi... CVE-2007-4727 Fix available EPSS 12.9% 6.8 MediumAugust 29, 2007
• lighttpd lighttpd 1.4.15, when run on 32 bit platforms, allows remote attackers to cause a denial of... CVE-2007-3950 Fix available 4.3 MediumJuly 24, 2007
• lighttpd mod_access.c in lighttpd 1.4.15 ignores trailing / (slash) characters in the URL, which allows... CVE-2007-3949 Fix available 8.3 HighJuly 24, 2007
• lighttpd connections.c in lighttpd before 1.4.16 might accept more connections than the configured maximum... CVE-2007-3948 Fix available 4.3 MediumJuly 24, 2007
• lighttpd request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service (daemon crash)... CVE-2007-3947 Public exploitFix available 5.8 MediumJuly 24, 2007
• lighttpd mod_auth (http_auth.c) in lighttpd before 1.4.16 allows remote attackers to cause a denial of... CVE-2007-3946 Fix available 6.4 MediumJuly 24, 2007
• lighttpd lighttpd before 1.4.14 allows attackers to cause a denial of service (crash) via a request to a... CVE-2007-1870 Fix available 7.8 HighApril 18, 2007
• lighttpd lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource... CVE-2007-1869 Fix available 5.0 MediumApril 18, 2007
• lighttpd response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote... CVE-2006-0814 EPSS 10.6% 5.0 MediumMarch 6, 2006
• lighttpd LightTPD 1.4.8 and earlier, when the web root is on a case-insensitive filesystem, allows remote... CVE-2006-0760 2.6 LowFebruary 18, 2006
• lighttpd The buffer_urldecode function in Lighttpd 1.3.7 and earlier does not properly handle control... CVE-2005-0453 5.0 MediumFebruary 16, 2005