Login Request a demo
Unscored severity · published Apr 18, 2007
CVE-2007-1869
lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource consumption) by disconnecting while lighttpd is parsing CRLF sequences, which…
–
CVSS
3.4%
EPSS
No
On KEV
Description
lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource consumption) by disconnecting while lighttpd is parsing CRLF sequences, which triggers an infinite loop and file descriptor consumption.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.4% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Lighttpd · Lighttpd
1.4.12; 1.4.13 · source: NVD
Affected product
LI
Lighttpd
Lighttpd
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-1869
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-1869
Vendor Advisory
http://secunia.com/advisories/24886
secunia.com
http://secunia.com/advisories/24947
secunia.com
http://secunia.com/advisories/24995
secunia.com
http://secunia.com/advisories/25166
secunia.com
http://secunia.com/advisories/25613
security.gentoo.org
http://security.gentoo.org/glsa/glsa-200705-07.xml
More from Lighttpd
9.8
CVE-2019-11072
lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact…
9.8
CVE-2014-2323
SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to…
9.1
CVE-2025-12642
lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing
7.5
CVE-2022-41556
A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by…
7.5
CVE-2022-37797
In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received