Description
Buffer overflow in the fcgi_env_add function in mod_proxy_backend_fastcgi.c in the mod_fastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the SCRIPT_FILENAME variable, aka a "header overflow."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lighttpd | 1.4.18-1 | — |
| Debian 13 | lighttpd | 1.4.18-1 | — |
| Debian 12 | lighttpd | 1.4.18-1 | — |
| Debian 4.0 | lighttpd | 1.4.13-4etch4 | DSA-1362-1 |
Advisories 1
- DSA-1362-1 lighttpd - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://issues.rpath.com/browse/RPL-1715
- 20070917 FLEA-2007-0054-1 lighttpd mailing-list
- FEDORA-2007-2132 vendor-advisory
- 26732 third-party-advisory
- GLSA-200709-16 vendor-advisory
- http://secweb.se/en/advisories/lighttpd-fastcgi-remote-vulnerability/
- 25622 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=284511
- http://www.lighttpd.net/assets/2007/9/9/lighttpd_sa_2007_12.txt
- lighttpd-modfastcgi-code-execution(36526) vdb-entry
- 3127 third-party-advisory
- 26997 third-party-advisory
- http://trac.lighttpd.net/trac/changeset/1986
- 26824 third-party-advisory
- ADV-2007-3110 vdb-entry
- 27229 third-party-advisory
- 26794 third-party-advisory
- SUSE-SR:2007:020 vendor-advisory