Unscored severity · published Mar 6, 2006
CVE-2006-0814
response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via requests that contain trailing (1) "."…
–
CVSS
10.6%
EPSS
No
On KEV
Description
response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via requests that contain trailing (1) "." (dot) and (2) space characters, which are ignored by Windows, as demonstrated by PHP files.
Exploitation
Is it being used?
Exploit prediction (EPSS)10.6% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Lighttpd · Lighttpd
1.0.2; 1.0.3; 1.1.0; 1.1.1; 1.1.2; 1.1.3; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-0814
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-0814
Patch
http://secunia.com/advisories/18886
Patch
http://secunia.com/secunia_research/2006-9/advisory/
securityreason.com
http://securityreason.com/securityalert/523
securitytracker.com
http://securitytracker.com/id?1015703
trac.lighttpd.net
http://trac.lighttpd.net/trac/changeset/1005
www.osvdb.org
http://www.osvdb.org/23542
More from Lighttpd
9.8
CVE-2019-11072
lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact…
9.8
CVE-2014-2323
SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to…
9.1
CVE-2025-12642
lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing
7.5
CVE-2022-41556
A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by…
7.5
CVE-2022-37797
In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received