Description
lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lighttpd | 1.4.33-1+nmu1 | — |
| Debian 13 | lighttpd | 1.4.33-1+nmu1 | — |
| Debian 12 | lighttpd | 1.4.33-1+nmu1 | — |
| Debian 7 | lighttpd | 1.4.31-4+deb7u1 | DSA-2795-1 |
| Debian 6.0 | lighttpd | 1.4.28-2+squeeze1.4 | DSA-2795-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | lighttpd | 1.4.37-1.6 | openSUSE-SU-2024:10402-1 |
Advisories 2
- DSA-2795-1 lighttpd - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10402-1 lighttpd-1.4.37-1.6 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 55682 third-party-advisory
- HPSBGN03191 vendor-advisory
- http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt
- openSUSE-SU-2014:0072 vendor-advisory
- DSA-2795 vendor-advisory
- [oss-security] 20131112 Re: CVE Request: lighttpd multiple issues (setuid/... unchecked return value, FAM: read after free) mailing-list
- https://kc.mcafee.com/corporate/index?page=content&id=SB10310
- JVN#37417423 third-party-advisory