Description
lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lighttpd | 1.4.19-5 | — |
| Debian 13 | lighttpd | 1.4.19-5 | — |
| Debian 12 | lighttpd | 1.4.19-5 | — |
| Debian 4.0 | lighttpd | 1.4.13-4etch11 | DSA-1645-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | lighttpd | 1.4.59-2.1 | openSUSE-SU-2024:10585-1 |
Advisories 2
- DSA-1645-1 lighttpd - various problems Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10585-1 lighttpd-1.4.59-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 32069 third-party-advisory
- http://trac.lighttpd.net/trac/changeset/2307
- http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt
- 32972 third-party-advisory
- http://trac.lighttpd.net/trac/changeset/2278
- http://wiki.rpath.com/Advisories:rPSA-2008-0309
- 31599 vdb-entry
- 32834 third-party-advisory
- http://trac.lighttpd.net/trac/ticket/1720
- http://trac.lighttpd.net/trac/changeset/2309
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309
- 32132 third-party-advisory
- [oss-security] 20080930 Re: CVE request: lighttpd issues mailing-list
- 20081030 rPSA-2008-0309-1 lighttpd mailing-list
- http://trac.lighttpd.net/trac/changeset/2310
- ADV-2008-2741 vdb-entry
- DSA-1645 vendor-advisory
- [oss-security] 20080930 Re: Re: CVE request: lighttpd issues mailing-list
- lighttpd-urlredirect-rewrite-info-disclosure(45690) vdb-entry
- [oss-security] 20080930 Re: CVE request: lighttpd issues mailing-list
- 32480 third-party-advisory
- http://www.lighttpd.net/security/lighttpd-1.4.x_rewrite_redirect_decode_url.patch
- SUSE-SR:2008:026 vendor-advisory
- GLSA-200812-04 vendor-advisory