Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-a8x5-pd8f-rfbg
Vulnerability ID VCID-a8x5-pd8f-rfbg
Aliases CVE-2011-4362
Summary Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.04391 https://api.first.org/data/v1/epss?cve=CVE-2011-4362
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2011-4362
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4362
652726 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=652726
CVE-2011-4362;OSVDB-77366 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/dos/18295.txt
GLSA-201406-10 https://security.gentoo.org/glsa/201406-10
Data source Exploit-DB
Date added Dec. 31, 2011
Description lighttpd - Denial of Service (PoC)
Ransomware campaign use Known
Source publication date Dec. 31, 2011
Exploit type dos
Platform linux
Source update date May 14, 2015
There are no known vectors.
Exploit Prediction Scoring System (EPSS)
Percentile 0.89158
EPSS Score 0.04391
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T13:41:24.308969+00:00 Debian Oval Importer Import https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.6.0