Description
Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lighttpd | 1.4.33-1+nmu1 | — |
| Debian 13 | lighttpd | 1.4.33-1+nmu1 | — |
| Debian 12 | lighttpd | 1.4.33-1+nmu1 | — |
| Debian 7 | lighttpd | 1.4.31-4+deb7u1 | DSA-2795-1 |
| Debian 6.0 | lighttpd | 1.4.28-2+squeeze1.4 | DSA-2795-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | lighttpd | 1.4.37-1.6 | openSUSE-SU-2024:10402-1 |
Advisories 2
- DSA-2795-1 lighttpd - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10402-1 lighttpd-1.4.37-1.6 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 55682 third-party-advisory
- HPSBGN03191 vendor-advisory
- http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_03.txt
- openSUSE-SU-2014:0072 vendor-advisory
- DSA-2795 vendor-advisory
- [oss-security] 20131112 Re: CVE Request: lighttpd multiple issues (setuid/... unchecked return value, FAM: read after free) mailing-list
- JVN#37417423 third-party-advisory