CVE-2018-25103
- Source
- https://cve.org/CVERecord?id=CVE-2018-25103
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-25103.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2018-25103
- Downstream
- Published
- 2024-06-17T18:15:12.650Z
- Modified
- 2026-04-10T04:10:14.534256Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
There exists use-after-free vulnerabilities in lighttpd <= 1.4.50 request parsing which might read from invalid pointers to memory used in the same request, not from other requests.
- References
-
- https://www.kb.cert.org/vuls/id/312260
- https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/2024/AMI-SA-2024002.pdf
- https://github.com/lighttpd/lighttpd1.4/commit/df8e4f95614e476276a55e34da2aa8b00b1148e9
- https://github.com/lighttpd/lighttpd1.4/commit/d161f53de04bc826ce1bdaeb3dce2c72ca50a3f8
- https://www.runzero.com/blog/lighttpd/
- https://blogvdoo.wordpress.com/2018/11/06/giving-back-securing-open-source-iot-projects/#more-736
Affected packages
Git / github.com/lighttpd/lighttpd1.4
Affected ranges
- Type
- GIT
- Repo
- https://github.com/lighttpd/lighttpd1.4
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Type
- GIT
- Repo
- https://github.com/lighttpd/lighttpd1.4
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Type
- GIT
- Repo
- https://github.com/lighttpd/lighttpd1.4
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Type
- GIT
- Repo
- https://github.com/lighttpd/lighttpd1.4
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
lighttpd-1.*
lighttpd-1.3.11
lighttpd-1.3.12
lighttpd-1.3.13
lighttpd-1.3.14
lighttpd-1.3.15
lighttpd-1.3.16
lighttpd-1.4.1
lighttpd-1.4.2
lighttpd-1.4.25
lighttpd-1.4.26
lighttpd-1.4.27
lighttpd-1.4.28
lighttpd-1.4.29
lighttpd-1.4.3
lighttpd-1.4.30
lighttpd-1.4.31
lighttpd-1.4.32
lighttpd-1.4.33
lighttpd-1.4.34
lighttpd-1.4.35
lighttpd-1.4.36
lighttpd-1.4.36--rc1
lighttpd-1.4.37
lighttpd-1.4.38
lighttpd-1.4.39
lighttpd-1.4.4
lighttpd-1.4.40
lighttpd-1.4.41
lighttpd-1.4.42
lighttpd-1.4.43
lighttpd-1.4.44
lighttpd-1.4.45
lighttpd-1.4.46
lighttpd-1.4.47
lighttpd-1.4.48
lighttpd-1.4.49
lighttpd-1.4.5
lighttpd-1.4.50
lighttpd-1.4.6
lighttpd-1.4.7