GCVE - cpe:2.3:a:lighttpd:lighttpd:1.2.7:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:lighttpd:lighttpd:1.2.7:*:*:*:*:*:*:*

part: a version: 1.2.7 update: *

Vendor	Lighttpd (`5206741e-6b14-56e0-b31f-406bdf611784`)
Product	Lighttpd (`5b6699d9-10ff-598e-a44b-38df5dc45b39`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/lighttpd`	purl2cpe	2026-06-01 10:17:10.719402
`pkg:deb/ubuntu/lighttpd`	purl2cpe	2026-06-01 10:17:10.719404
`pkg:github/lighttpd/lighttpd1.4`	purl2cpe	2026-06-01 10:17:10.719405
`pkg:github/lighttpd/lighttpd2`	purl2cpe	2026-06-01 10:17:10.719406
`pkg:rpm/fedora/lighttpd`	purl2cpe	2026-06-01 10:17:10.719408
`pkg:rpm/opensuse/lighttpd`	purl2cpe	2026-06-01 10:17:10.719409

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2010-0295`	vulnerable	2026-06-08 04:52:01.599887	Details available lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate. Published: 2010-02-03T19:00:00.000Z Updated: 2024-08-07T00:45:11.703Z Open on db.gcve.eu Reference links http://secunia.com/advisories/38403 http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2711 http://www.vupen.com/english/advisories/2011/0172 http://secunia.com/advisories/39765 http://redmine.lighttpd.net/issues/2147	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-4298`	vulnerable	2026-06-08 04:50:38.517645	Details available Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests with duplicate request headers. Published: 2008-09-27T00:00:00.000Z Updated: 2024-08-07T10:08:34.967Z Open on db.gcve.eu Reference links http://secunia.com/advisories/32069 http://bugs.gentoo.org/show_bug.cgi?id=238180 http://secunia.com/advisories/32972 http://www.openwall.com/lists/oss-security/2008/09/26/5 http://trac.lighttpd.net/trac/changeset/2305	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-0814`	vulnerable	2026-06-08 04:48:55.414501	Details available response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via requests that contain trailing (1) "." (dot) and (2) space characters, which are ignored by Windows, as demonstrated by PHP files. Published: 2006-03-06T21:00:00.000Z Updated: 2024-08-07T16:48:56.456Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/426446/100/0/threaded http://trac.lighttpd.net/trac/changeset/1005 http://www.osvdb.org/23542 http://secunia.com/advisories/18886 http://www.vupen.com/english/advisories/2006/0782	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-0760`	vulnerable	2026-06-08 04:48:55.191748	Details available LightTPD 1.4.8 and earlier, when the web root is on a case-insensitive filesystem, allows remote attackers to bypass URL checks and obtain sensitive information via file extensions with unexpected capitalization, as demonstrated by a request for index.PHP when the configuration invokes the PHP interpreter only for ".php" names. Published: 2006-02-18T02:00:00.000Z Updated: 2024-08-07T16:48:55.669Z Open on db.gcve.eu Reference links http://lighttpd.net/news/ http://www.vupen.com/english/advisories/2006/0550 http://secunia.com/advisories/18869 http://www.lighttpd.net/news/ http://www.osvdb.org/23229	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.