CVE-2020-13111: Naviserver Project Naviserver

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

NaviServer 4.99.4 to 4.99.19 allows denial of service due to the nsd/driver.c ChunkedDecode function not properly validating the length of a chunk. A remote attacker can craft a chunked-transfer request that will result in a negative value being passed to memmove via the size parameter, causing the process to crash.

Affected products

• Naviserver Project Naviserver: from 4.99.4, up to and including 4.99.19

Published 2020-05-16. Last modified 2026-06-17.