GCVE - cpe:2.3:a:lighttpd:lighttpd:1.4.6:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:lighttpd:lighttpd:1.4.6:*:*:*:*:*:*:*

part: a version: 1.4.6 update: *

Vendor	Lighttpd (`5206741e-6b14-56e0-b31f-406bdf611784`)
Product	Lighttpd (`5b6699d9-10ff-598e-a44b-38df5dc45b39`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/lighttpd`	purl2cpe	2026-06-01 10:17:10.756169
`pkg:deb/ubuntu/lighttpd`	purl2cpe	2026-06-01 10:17:10.756171
`pkg:github/lighttpd/lighttpd1.4`	purl2cpe	2026-06-01 10:17:10.756172
`pkg:github/lighttpd/lighttpd2`	purl2cpe	2026-06-01 10:17:10.756173
`pkg:rpm/fedora/lighttpd`	purl2cpe	2026-06-01 10:17:10.756175
`pkg:rpm/opensuse/lighttpd`	purl2cpe	2026-06-01 10:17:10.756176

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-1427`	vulnerable	2026-06-08 05:03:53.903964	Details available The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP via a symlink attack or a race condition. Published: 2013-03-21T17:00:00.000Z Updated: 2024-08-06T15:04:48.266Z Open on db.gcve.eu Reference links http://osvdb.org/91462 https://exchange.xforce.ibmcloud.com/vulnerabilities/82897 http://www.securityfocus.com/bid/58528 http://www.debian.org/security/2013/dsa-2649	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-0295`	vulnerable	2026-06-08 04:52:01.612632	Details available lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate. Published: 2010-02-03T19:00:00.000Z Updated: 2024-08-07T00:45:11.703Z Open on db.gcve.eu Reference links http://secunia.com/advisories/38403 http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2711 http://www.vupen.com/english/advisories/2011/0172 http://secunia.com/advisories/39765 http://redmine.lighttpd.net/issues/2147	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-4298`	vulnerable	2026-06-08 04:50:38.531566	Details available Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests with duplicate request headers. Published: 2008-09-27T00:00:00.000Z Updated: 2024-08-07T10:08:34.967Z Open on db.gcve.eu Reference links http://secunia.com/advisories/32069 http://bugs.gentoo.org/show_bug.cgi?id=238180 http://secunia.com/advisories/32972 http://www.openwall.com/lists/oss-security/2008/09/26/5 http://trac.lighttpd.net/trac/changeset/2305	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-1870`	vulnerable	2026-06-08 04:49:43.721097	Details available lighttpd before 1.4.14 allows attackers to cause a denial of service (crash) via a request to a file whose mtime is 0, which results in a NULL pointer dereference. Published: 2007-04-18T02:20:00.000Z Updated: 2024-08-07T13:13:41.739Z Open on db.gcve.eu Reference links http://secunia.com/advisories/25613 http://security.gentoo.org/glsa/glsa-200705-07.xml http://www.vupen.com/english/advisories/2007/1399 http://secunia.com/advisories/24947 http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_02.txt	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-0814`	vulnerable	2026-06-08 04:48:55.414968	Details available response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via requests that contain trailing (1) "." (dot) and (2) space characters, which are ignored by Windows, as demonstrated by PHP files. Published: 2006-03-06T21:00:00.000Z Updated: 2024-08-07T16:48:56.456Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/426446/100/0/threaded http://trac.lighttpd.net/trac/changeset/1005 http://www.osvdb.org/23542 http://secunia.com/advisories/18886 http://www.vupen.com/english/advisories/2006/0782	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-0760`	vulnerable	2026-06-08 04:48:55.209145	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.