Description
lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource consumption) by disconnecting while lighttpd is parsing CRLF sequences, which triggers an infinite loop and file descriptor consumption.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lighttpd | 1.4.15-1 | — |
| Debian 13 | lighttpd | 1.4.15-1 | — |
| Debian 12 | lighttpd | 1.4.15-1 | — |
| Debian 4.0 | lighttpd | 1.4.13-4etch1 | DSA-1303-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | lighttpd | 1.4.59-2.1 | openSUSE-SU-2024:10585-1 |
Advisories 2
- DSA-1303-1 lighttpd - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10585-1 lighttpd-1.4.59-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 25613 third-party-advisory
- GLSA-200705-07 vendor-advisory
- ADV-2007-1399 vdb-entry
- 24947 third-party-advisory
- SUSE-SR:2007:007 vendor-advisory
- lighttpd-rnrn-dos(33671) vdb-entry
- 24995 third-party-advisory
- https://issues.rpath.com/browse/RPL-1218
- DSA-1303 vendor-advisory
- 23515 vdb-entry
- http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_01.txt
- 20070420 FLEA-2007-0011-1: lighttpd mailing-list
- 25166 third-party-advisory
- 24886 third-party-advisory