CVE-2018-25103: Lighttpd

Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days.

There exists use-after-free vulnerabilities in lighttpd <= 1.4.50 request parsing which might read from invalid pointers to memory used in the same request, not from other requests.

Affected products

• Lighttpd Lighttpd: up to and including 1.4.50

Published 2024-06-17. Last modified 2026-06-17.