Denial-of-Service Vulnerability in Lighttpd and Varnish Packages
Summary
UBUNTU-CVE-2025-8671: A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to d... Affects lighttpd versions 1.4.31-3ubuntu3 – 1.4.33-1ubuntu1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Lighttpd is a lightweight web server designed for high-performance environments, while Varnish is a web application accelerator that caches content to improve load times. Both packages are widely used in web hosting and application delivery. This vulnerability affects their ability to handle HTTP/2 streams, potentially leading to service disruptions.
Vulnerability Detail
A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them using malformed frames or flow control errors, an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection.
How To Fix
No fixed version is published for this vulnerability.
To rectify the vulnerability, update the affected packages to their patched versions. For example, you can run the following commands in your terminal:
sudo apt update
sudo apt upgrade lighttpd varnish
Ensure that you are using the latest versions:
- Lighttpd: 1.4.63-1ubuntu3.1 or later
- Varnish: 6.6.1-1ubuntu0.2 or later.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider limiting the number of concurrent streams that can be opened by clients or implementing rate limiting to mitigate the impact of potential attacks until the packages can be updated.
Conclusion
This vulnerability poses a significant risk to web services using Lighttpd and Varnish, potentially leading to denial-of-service attacks. It is crucial for users to update their packages to the latest versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for lighttpd →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Affected versions include Lighttpd 1.4.33-1+nmu2ubuntu2.1+esm1 and Varnish 3.0.5-2ubuntu0.1, among others listed in the vulnerability report.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The vulnerability can lead to denial-of-service (DoS) attacks, causing excessive resource consumption and potentially making the affected web services unavailable.
Yes, the permanent fix is to update the affected packages to their patched versions as soon as they are available.
Related vulnerabilities
Recent vulnerabilities recorded for lighttpd.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.