CVE catalog

CVE-2025-12642

lighttpd: CVE-2025-12642

Severity: Medium · CVSS 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Nov 3, 2025, 8:17:06 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.37% · Oct 25, 2026

lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: * Bypass access control rules * Inject unsafe input into backend logic that trusts request headers * Execute HTTP Request Smuggling attacks under some conditions This issue affects lighttpd1.4.80

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	lighttpd	sid	`1.4.85-1`	not affected
Debian	lighttpd	forky	`1.4.85-1`	not affected
Debian	lighttpd	trixie	`1.4.79-2`	not affected
Debian	lighttpd	bookworm	`1.4.69-1`	not affected
Cpe	lighttpd	Not reported	Not reported	unknown

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	lighttpd	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	lighttpd	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	lighttpd	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	lighttpd	source	bookworm	`Not affected`	unimportant	Not reported	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[lighttpd]Not affected
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
- 1.4.69-1 · arm64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
[lighttpd-doc]Not affected
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · all · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
- 1.4.69-1 · all · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
[lighttpd-mod-authn-gssapi]Not affected
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
- 1.4.69-1 · arm64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
[lighttpd-mod-authn-pam]Not affected
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
- 1.4.69-1 · arm64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
[lighttpd-mod-authn-sasl]Not affected
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
- 1.4.69-1 · arm64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
[lighttpd-mod-deflate]Not affected
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
- 1.4.69-1 · arm64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
[lighttpd-mod-gnutls]Not affected
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
- 1.4.69-1 · arm64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
[lighttpd-mod-maxminddb]Not affected
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
- 1.4.69-1 · arm64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
[lighttpd-mod-mbedtls]Not affected
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
- 1.4.69-1 · arm64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
[lighttpd-mod-nss]Not affected
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
- 1.4.69-1 · arm64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
[lighttpd-mod-openssl]Not affected
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
- 1.4.69-1 · arm64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
[lighttpd-modules-dbi]Not affected
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
- 1.4.69-1 · arm64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
[lighttpd-modules-ldap]Not affected
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
- 1.4.69-1 · arm64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
[lighttpd-modules-lua]Not affected
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
- 1.4.69-1 · arm64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
[lighttpd-modules-mysql]Not affected
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
- 1.4.69-1 · arm64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
[lighttpd-mod-vhostdb-pgsql]Not affected
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
- 1.4.69-1 · arm64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
[lighttpd-mod-webdav]Not affected
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
- 1.4.69-1 · arm64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
[lighttpd-mod-wolfssl]Not affected
Source package: [lighttpd]
Details (2)
- 1.4.69-1 · amd64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm
- 1.4.69-1 · arm64 · bookworm
  Not affected
  dsa · lighttpd · debian · bookworm

Observed: Oct 24, 2026, 4:53:10 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)]