CVE catalog

CVE-2019-11072

lighttpd: CVE-2019-11072

Severity: High · CVSS 7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Published: Apr 9, 2019, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 73.76% · Oct 25, 2026

lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malicious HTTP GET request, as demonstrated by mishandling of /%2F? in burl_normalize_2F_to_slash_fix in burl.c. NOTE: The developer states "The feature which can be abused to cause the crash is a new feature in lighttpd 1.4.50, and is not enabled by default. It must be explicitly configured in the config file (e.g. lighttpd.conf). Certain input will trigger an abort() in lighttpd when that feature is enabled. lighttpd detects the underflow or realloc() will fail (in both 32-bit and 64-bit executables), also detected in lighttpd. Either triggers an explicit abort() by lighttpd. This is not exploitable beyond triggering the explicit abort() with subsequent application exit.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	lighttpd	sid	`1.4.85-1`	fixed
Debian	lighttpd	forky	`1.4.85-1`	fixed
Debian	lighttpd	trixie	`1.4.79-2`	fixed
Debian	lighttpd	bookworm	`1.4.69-1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	lighttpd	source	sid	`1.4.53-4`	not yet assigned	Not reported	[926885]
Debian	lighttpd	source	forky	`1.4.53-4`	not yet assigned	Not reported	[926885]
Debian	lighttpd	source	trixie	`1.4.53-4`	not yet assigned	Not reported	[926885]
Debian	lighttpd	source	bookworm	`1.4.53-4`	not yet assigned	Not reported	[926885]

[Debian bug #926885]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[lighttpd]Fixed
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
- 1.4.69-1 · arm64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
[lighttpd-doc]Fixed
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · all · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
- 1.4.69-1 · all · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
[lighttpd-mod-authn-gssapi]Fixed
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
- 1.4.69-1 · arm64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
[lighttpd-mod-authn-pam]Fixed
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
- 1.4.69-1 · arm64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
[lighttpd-mod-authn-sasl]Fixed
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
- 1.4.69-1 · arm64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
[lighttpd-mod-deflate]Fixed
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
- 1.4.69-1 · arm64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
[lighttpd-mod-gnutls]Fixed
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
- 1.4.69-1 · arm64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
[lighttpd-mod-maxminddb]Fixed
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
- 1.4.69-1 · arm64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
[lighttpd-mod-mbedtls]Fixed
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
- 1.4.69-1 · arm64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
[lighttpd-mod-nss]Fixed
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
- 1.4.69-1 · arm64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
[lighttpd-mod-openssl]Fixed
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
- 1.4.69-1 · arm64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
[lighttpd-modules-dbi]Fixed
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
- 1.4.69-1 · arm64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
[lighttpd-modules-ldap]Fixed
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
- 1.4.69-1 · arm64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
[lighttpd-modules-lua]Fixed
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
- 1.4.69-1 · arm64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
[lighttpd-modules-mysql]Fixed
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
- 1.4.69-1 · arm64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
[lighttpd-mod-vhostdb-pgsql]Fixed
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
- 1.4.69-1 · arm64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
[lighttpd-mod-webdav]Fixed
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
- 1.4.69-1 · arm64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
[lighttpd-mod-wolfssl]Fixed
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12
- 1.4.69-1 · arm64 · bookworm
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · bookworm; dsa · lighttpd · debian · 12

[Debian 13 (Trixie)]

[lighttpd]Fixed
Details (2)
- 1.4.79-2 · amd64 · trixie
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · 13
- 1.4.79-2 · arm64 · trixie
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · 13
[lighttpd-doc]Fixed
Source package: [lighttpd]
Details (2)
- 1.4.79-2 · all · trixie
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · 13
- 1.4.79-2 · all · trixie
  Fixed · Fixed: 1.4.53-4
  dsa · lighttpd · debian · 13

Next results

Observed: Oct 23, 2026, 5:38:30 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]