lighttpd
Security Risk Profile
59
/100
mediumSecurity Risk Score
Comprehensive risk assessment based on 42 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from February 16, 2005 to present
42
Total CVEs
17
Critical+High
0
Exploited
4
Unpatched
Threat Assessment
Avg CVSS
6.2
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
4
Critical/High
Risk Level
59/100
medium
Severity Distribution
Critical
5High
12Medium
21Low
3Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
3Age Distribution
Common Weaknesses (CWE)
1
Buffer Overflow
5
2
Infoleak
4
3
Use After Free
2
4
Null Pointer Dereference
2
5
Path Traversal
2
Most Affected Products
1. Lighttpd Lighttpd320
2. Debian Debian Linux25
3. openSUSE openSUSE15
4. SUSE SUSE Linux Enterprise Server7
5. debian/lighttpd6
Recent Vulnerabilities
See more →CVE-2026-22904
CVSS 9.8EPSS 0%critical
Stack Overflow via Oversized Cookie Fields in lighttpd
2/9/2026🔧 No Patch
CVE-2026-22903
CVSS 9.8EPSS 0%critical
Stack Overflow via SESSIONID Cookie in lighttpd
2/9/2026🔧 No Patch
CVE-2025-12642
CVSS 9.1critical
HTTP Header Smuggling via Trailer Merge
11/3/2025
CVE-2025-8759
CVSS 2.9EPSS 0%low
TRENDnet TN-200 Lighttpd hard-coded key
8/9/2025🔧 No Patch
CVE-2024-6198
CVSS 7.7high
SNORE Interface Unauthenticated Remote Code Execution
4/25/2025
CVE-2018-25103
CVSS 5.3medium
Use-after-free vulnerabilities in lighttpd <= 1.4.50
6/17/2024🔧 No Patch
https://seclists.org/oss-sec/2023/q4/95
unknown
CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
10/13/2023🔧 No Patch
CVE-2022-41556
CVSS 7.5high
10/6/2022
CVE-2022-37797
CVSS 7.5high
9/12/2022
CVE-2022-30780
CVSS 7.5high
6/11/2022
Monitor lighttpd in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.