CVE-2008-0983: Lighttpd

Medium severity, CVSS 5.0. EPSS: 2.3% chance of exploitation in the next 30 days.

lighttpd 1.4.18, and possibly other versions before 1.5.0, does not properly calculate the size of a file descriptor array, which allows remote attackers to cause a denial of service (crash) via a large number of connections, which triggers an out-of-bounds access.

Affected products

• Lighttpd Lighttpd: version 1.4.7 only; version 1.4.8 only; version 1.4.9 only; version 1.4.10 only; version 1.4.11 only; version 1.4.12 only; …

Published 2008-02-26. Last modified 2026-06-16.