VULNERABILITY INTELLIGENCE

CVE-2025-12642

CVSS score9.1 CRITICAL
EPSS probability0.37%
CISA KEVNot currently listed
Published2025-11-03
Last modified2026-10-19
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: * Bypass access control rules * Inject unsafe input into backend logic that trusts request headers * Execute HTTP Request Smuggling attacks under some conditions This issue affects lighttpd1.4.80

Weakness classification

  • 1c6b5737-9389-4011-8117-89fa251edfb2: CWE-444

Primary references