7 matches found
CVE-2025-12642
lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: Bypass access control rules Inject unsafe input into backend logic that trusts reque...
Lighttpd < 1.4.80 DoS Vulnerability (MadeYouReset)
Lighttpd is prone to a denial of service DoS vulnerability in the HTTP/2 protocol dubbed SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
lighttpd 1.4.56 < 1.4.59 Denial of Service
According to its banner, the version of lighttpd running on the remote host is 1.4.56, 1.4.57 or 1.4.58. It is, therefore, affected by a a denial of service because connectionreadheadermore in connections.c has a typo that disrupts use of multiple read operations on large headers. Note that the...
lighttpd 1.4.31 http_request_split_value Function Header Handling DoS
According to its banner, the version of lighttpd running on the remote host is 1.4.31. It is, therefore, affected by a denial of service vulnerability. An error in the httprequestsplitvalue function in 'src/request.c' can cause the application to enter an endless loop when handling specially...
Khan Academy: Lighttpd version disclosure / directory listing
Hello there, the website at http://graphite.khanacademy.org/ isn't configured correctly. It displays the lighttpd version as well the directory contents. You should disable these features in your lighttpd.conf / php.ini. PoC: Index of / Name Last Modified Size Type Parent Directory/ - Directory...