TI-2019-08280 Aliases CVE-2019-11072 GHSA-59gp-rjv5-p2h6

lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers…

HIGH 80CWE-190Published 2019-04-10 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-190 and the CVSS impact.

Summary

lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malicious HTTP GET request, as demonstrated by mishandling of /%2F? in burl_normalize_2F_to_slash_fix in burl.c. NOTE: The developer states "The feature which can be abused to cause the crash is a new feature in lighttpd 1.4.50, and is not enabled by default. It must be explicitly configured in the config file (e.g. lighttpd.conf). Certain input will trigger an abort() in lighttpd when that feature is enabled. lighttpd detects the underflow or realloc() will fail (in both 32-bit and 64-bit executables), also detected in lighttpd. Either triggers an explicit abort() by lighttpd. This is not exploitable beyond triggering the explicit abort() with subsequent application exit.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.73762 99th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:lighttpd:lighttpd::::::::	up to 1.4.53	Vulnerable	lighttpd

cpe:2.3:a:lighttpd:lighttpd:*:*:*:*:*:*:*:* Versions up to 1.4.53 Vulnerable ·lighttpd

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2019-11072
2026-10-03 Alias added: GHSA-59gp-rjv5-p2h6

References

Exploit 1

https://redmine.lighttpd.net/issues/2945

Patch 1

https://github.com/lighttpd/lighttpd1.4/commit/32120d5b8b3203fc21ccb9eafb0eaf824bb59354

TI-2014-01841 SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote… CVSS 3.1CRITICAL 9.8
TI-2022-12909 Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU… CVSS 3.1HIGH 7.5
TI-2018-13505 An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before… CVSS 3.1HIGH 7.5
TI-2014-01842 Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost… CVSS 2.0MEDIUM 5.0
TI-2013-04004 lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or… CVSS 2.0HIGH 7.6
TI-2015-02830 mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log… CVSS 3.0HIGH 7.5

See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences