CVE-2007-3947: Medium severity Lighttpd Lighttpd vulnerability
request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service (daemon crash) by sending an HTTP request with duplicate headers, as demonstrated by a request containing two Location header lines, which results in a segmentation fault.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-3947?
CVE-2007-3947 has been classified as a moderate severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2007-3947?
To mitigate CVE-2007-3947, upgrade to lighttpd version 1.4.16 or later, which addresses this issue.
What impact does CVE-2007-3947 have on lighttpd servers?
CVE-2007-3947 can cause a lighttpd server to crash when processing HTTP requests with duplicate headers.
Which versions of lighttpd are affected by CVE-2007-3947?
CVE-2007-3947 affects all lighttpd versions up to and including 1.4.15.
Is there a workaround for CVE-2007-3947 if I cannot upgrade?
A possible workaround for CVE-2007-3947 is to implement a reverse proxy or web application firewall that filters out requests with duplicate headers.