mod_auth (http_auth.c) in lighttpd before 1.4.16 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors involving (1) a memory leak, (2) use of md5-sess without a cnonce, (3) base64 encoded strings, and (4) trailing whitespace in the Auth-Digest header.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade lighttpd | Jul 30, 2024 | Jul 24, 2007 |
| Gentoo Linux | — | Upgrade www-servers/lighttpd. | Oct 30, 2017 | Jul 23, 2007 |
| Http Lighttpd | — | Upgrade to the latest version of lighttpd | Dec 8, 2014 | Jul 23, 2007 |
| Suse | — | Upgrade suse-releaseUpgrade lighttpd | Feb 17, 2015 | Jul 23, 2007 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub