CVE-2007-4727: Lighttpd

Medium severity, CVSS 6.8. EPSS: 12.9% chance of exploitation in the next 30 days.

Buffer overflow in the fcgi_env_add function in mod_proxy_backend_fastcgi.c in the mod_fastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the SCRIPT_FILENAME variable, aka a "header overflow."

Affected products

• Lighttpd Lighttpd: up to and including 1.4.15

Published 2007-09-12. Last modified 2026-06-16.