Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-dfsz-ztg5-rkf8
Vulnerability ID VCID-dfsz-ztg5-rkf8
Aliases CVE-2019-11072
Summary lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malicious HTTP GET request, as demonstrated by mishandling of /%2F? in burl_normalize_2F_to_slash_fix in burl.c. NOTE: The developer states "The feature which can be abused to cause the crash is a new feature in lighttpd 1.4.50, and is not enabled by default. It must be explicitly configured in the config file (e.g. lighttpd.conf). Certain input will trigger an abort() in lighttpd when that feature is enabled. lighttpd detects the underflow or realloc() will fail (in both 32-bit and 64-bit executables), also detected in lighttpd. Either triggers an explicit abort() by lighttpd. This is not exploitable beyond triggering the explicit abort() with subsequent application exit.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.12083 https://api.first.org/data/v1/epss?cve=CVE-2019-11072
ssvc Track https://github.com/lighttpd/lighttpd1.4/commit/32120d5b8b3203fc21ccb9eafb0eaf824bb59354
ssvc Track https://redmine.lighttpd.net/issues/2945
ssvc Track http://www.securityfocus.com/bid/107907
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2019-11072
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11072
107907 http://www.securityfocus.com/bid/107907
2945 https://redmine.lighttpd.net/issues/2945
32120d5b8b3203fc21ccb9eafb0eaf824bb59354 https://github.com/lighttpd/lighttpd1.4/commit/32120d5b8b3203fc21ccb9eafb0eaf824bb59354
926885 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=926885
No exploits are available.
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-11T20:27:33Z/ Found at https://github.com/lighttpd/lighttpd1.4/commit/32120d5b8b3203fc21ccb9eafb0eaf824bb59354
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-11T20:27:33Z/ Found at https://redmine.lighttpd.net/issues/2945
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-11T20:27:33Z/ Found at http://www.securityfocus.com/bid/107907
Exploit Prediction Scoring System (EPSS)
Percentile 0.93908
EPSS Score 0.12083
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T13:43:52.015482+00:00 Debian Oval Importer Import https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.6.0