GCVE - cpe:2.3:a:lighttpd:lighttpd:1.4.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:lighttpd:lighttpd:1.4.1:*:*:*:*:*:*:*

part: a version: 1.4.1 update: *

Vendor	Lighttpd (`5206741e-6b14-56e0-b31f-406bdf611784`)
Product	Lighttpd (`5b6699d9-10ff-598e-a44b-38df5dc45b39`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/lighttpd`	purl2cpe	2026-06-01 10:17:10.755654
`pkg:deb/ubuntu/lighttpd`	purl2cpe	2026-06-01 10:17:10.755655
`pkg:github/lighttpd/lighttpd1.4`	purl2cpe	2026-06-01 10:17:10.755656
`pkg:github/lighttpd/lighttpd2`	purl2cpe	2026-06-01 10:17:10.755658
`pkg:rpm/fedora/lighttpd`	purl2cpe	2026-06-01 10:17:10.755659
`pkg:rpm/opensuse/lighttpd`	purl2cpe	2026-06-01 10:17:10.755660

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2008-4298`	vulnerable	2026-06-08 04:50:38.529141	Details available Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests with duplicate request headers. Published: 2008-09-27T00:00:00.000Z Updated: 2024-08-07T10:08:34.967Z Open on db.gcve.eu Reference links http://secunia.com/advisories/32069 http://bugs.gentoo.org/show_bug.cgi?id=238180 http://secunia.com/advisories/32972 http://www.openwall.com/lists/oss-security/2008/09/26/5 http://trac.lighttpd.net/trac/changeset/2305	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-1870`	vulnerable	2026-06-08 04:49:43.718654	Details available lighttpd before 1.4.14 allows attackers to cause a denial of service (crash) via a request to a file whose mtime is 0, which results in a NULL pointer dereference. Published: 2007-04-18T02:20:00.000Z Updated: 2024-08-07T13:13:41.739Z Open on db.gcve.eu Reference links http://secunia.com/advisories/25613 http://security.gentoo.org/glsa/glsa-200705-07.xml http://www.vupen.com/english/advisories/2007/1399 http://secunia.com/advisories/24947 http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_02.txt	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-0814`	vulnerable	2026-06-08 04:48:55.414879	Details available response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via requests that contain trailing (1) "." (dot) and (2) space characters, which are ignored by Windows, as demonstrated by PHP files. Published: 2006-03-06T21:00:00.000Z Updated: 2024-08-07T16:48:56.456Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/426446/100/0/threaded http://trac.lighttpd.net/trac/changeset/1005 http://www.osvdb.org/23542 http://secunia.com/advisories/18886 http://www.vupen.com/english/advisories/2006/0782	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-0760`	vulnerable	2026-06-08 04:48:55.206035	Details available LightTPD 1.4.8 and earlier, when the web root is on a case-insensitive filesystem, allows remote attackers to bypass URL checks and obtain sensitive information via file extensions with unexpected capitalization, as demonstrated by a request for index.PHP when the configuration invokes the PHP interpreter only for ".php" names. Published: 2006-02-18T02:00:00.000Z Updated: 2024-08-07T16:48:55.669Z Open on db.gcve.eu Reference links http://lighttpd.net/news/ http://www.vupen.com/english/advisories/2006/0550 http://secunia.com/advisories/18869 http://www.lighttpd.net/news/ http://www.osvdb.org/23229	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.