Lighttpd vulnerabilities
We track 4 vulnerabilities in Lighttpd products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2025.
Latest Lighttpd vulnerabilities
- 9.1 Critical severity
lighttpd: Inconsistent Interpretation of HTTP Requests
lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: * Bypass access control rules * Inject unsafe i
- 7.5 High severity
Lighttpd: Missing Release of Memory after Effective Lifetime
A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/1.1 chunked situation
- 7.5 High severity
Lighttpd: NULL Pointer Dereference
In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denia
- 7.5 High severity
Lighttpd: Incorrect Calculation
Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c has a typo that disrupts use of multiple read operations on large headers.