Critical Signed Integer Overflow in Lighttpd - CVE-2019-11072
Summary
CVE-2019-11072: lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malicious HTTP GET request, as dem... Affects lighttpd across 2 version ranges.
< 1.4.53-4
< 32120d5b8b3203fc21ccb9eafb0eaf824bb59354
Fixed in 1.4.53-4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Lighttpd is a high-performance web server designed for speed-critical environments. It is known for its lightweight footprint and ability to handle large numbers of concurrent connections efficiently. However, versions prior to 1.4.54 are vulnerable to a signed integer overflow, which can lead to application crashes and potential denial of service.
Vulnerability Detail
CVE-2019-11072 is a signed integer overflow vulnerability found in Lighttpd versions before 1.4.54. This flaw can be exploited by remote attackers through crafted HTTP GET requests, specifically targeting the mishandling of the '/%2F?' input in the burl_normalize_2F_to_slash_fix function within burl.c. Although the feature that allows this vulnerability is not enabled by default, if configured, it can lead to an application crash via an abort() call. The vulnerability is not exploitable beyond triggering this abort, but it poses a significant risk if the feature is enabled.
How To Fix
Minimum fixed version
1.4.53-4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade lighttpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, you can disable the specific feature that triggers the vulnerability in your Lighttpd configuration file (lighttpd.conf). Ensure that the feature is not enabled by commenting out or removing the relevant configuration lines.
Conclusion
CVE-2019-11072 represents a critical vulnerability in Lighttpd that can lead to denial of service if exploited. Users are strongly advised to upgrade to version 1.4.54 or later to ensure their systems are secure. For those unable to upgrade immediately, disabling the vulnerable feature in the configuration file serves as a temporary workaround.
See every vulnerability recorded for lighttpd →
FAQ
CVE-2019-11072 is a vulnerability in Lighttpd that allows remote attackers to cause a denial of service through a signed integer overflow.
Lighttpd versions prior to 1.4.54 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2019-11072 is 9.8, indicating a critical level of severity.
Yes, you can disable the specific feature in the Lighttpd configuration file to mitigate the risk until an upgrade can be performed.
Related vulnerabilities
Recent vulnerabilities recorded for lighttpd.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
