CVE-2007-3947: Lighttpd

Medium severity, CVSS 5.8. EPSS: 8.1% chance of exploitation in the next 30 days.

request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service (daemon crash) by sending an HTTP request with duplicate headers, as demonstrated by a request containing two Location header lines, which results in a segmentation fault.

Affected products

• Lighttpd Lighttpd: up to and including 1.4.15

Published 2007-07-24. Last modified 2026-06-16.