PT-2025-44791 · Lighttpd · Lighttpd

Published 2025-11-03 · Updated 2025-11-12 · CVE-2025-12642

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions lighttpd version 1.4.80

Description The software improperly merges trailer fields into headers following HTTP request parsing, which can be leveraged to carry out HTTP Header Smuggling attacks. Successful exploitation could allow an attacker to bypass access control rules and inject unsafe input into backend logic that relies on request headers. It may also enable the execution of HTTP Request Smuggling attacks under certain circumstances.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2025-12642

Affected Products

Lighttpd

References · 8

• https://github.com/lighttpd/lighttpd1.4/commit/35cb89c103877de62d6b63d0804255475d77e5e1 · Patch
• https://cve.org/CVERecord?id=CVE-2025-12642 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-12642 · Security Note
• https://ubuntu.com/security/CVE-2025-12642 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-12642 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-12642 · Vendor Advisory
• https://t.me/CVEtracker/36442 · Telegram Post
• https://t.me/cveNotify/142541 · Telegram Post