search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Use-after-free vulnerability in lighttpd version 1.4.50 and earlier

Vulnerability Note VU#312260

Original Release Date: 2024-07-09 | Last Revised: 2024-07-10


A use-after-free vulnerability in lighttpd in versions 1.4.50 and earlier permits a remote, unauthenticated attacker to trigger lighttpd to read from invalid pointers in memory. The attacker can use crafted HTTP Requests to crash the web server and/or leak memory in order to access sensitive data. This vulnerability was fixed in 2018 by the lighttpd project. However, a number of implementations of lighttpd remain vulnerable due to a failure to apply the security updates provided by lighttpd.


lighttpd is a lightweight web server software that is meant for low resource environments with limited CPU and memory. This open-source software is available in binary form and source code that is included in various IoT and firmware environments. In November of 2018, VDOO researchers disclosed a vulnerability related to the HTTP header parsing code in lighttpd versions 1.4.50 and earlier. This security issue was fixed by lighttpd as part of their 1.4.51 release in August 2018. At the time of disclosure, VDOO researchers identified the primary impact to be Denial of Service (DoS) using the released memory pointer.

However, a CVE ID was not obtained as part of the fix outlined above, leaving the vulnerability without a public identifier. In April of 2024, Binarly discovered that the lighttpd vulnerability was still present in a number of products, presenting a supply-chain risk. The lack of CVE ID rendered the security fix invisible to projects that utilize earlier versions of lighttpd. Many organizations depend on a public CVE ID record to initiate security fixes and apply software updates. Binarly also documented many implementations of lighttpd (versions 1.4.50 and earlier) that allowed for a different set of attacks that can leak memory and access sensitive data. The supply-chain impact of this vulnerable software includes multiple products as highlighted in the blog by runZero. The lighttpd project has now obtained CVE-2018-25103 to identify this vulnerability and to alert supply-chain partners to implement the required fix.


The impact of this vulnerability varies largely due to the various ways lighttpd can be used a web server in various product implementations. In general, a remote unauthenticated attacker can use crafted HTTP Requests to crash the web server and/or leak memory in order to access sensitive data, such as process memory addresses.


The CERT/CC recommends applying the latest vendor-provided patch to address this issue. Review the Vendor Information below or contact your vendor or supplier for specific mitigation advice. If your device's implementation of lighttpd is deemed end-of-life or end-of-support, replace your hardware or software as appropriate to avoid exposure to this vulnerability. Operators can also limit network access to lighttpd implementations to avoid exposure of this software to the public Internet and untrusted sources.


Thanks to Binarly for highlighting this vulnerability in supply-chain implementations. Thanks to Ori Hollander, VDOO for identifying and reporting the vulnerability in 2018. Thanks also to lighttpd project and vendor AMI that cooperated in supporting this public disclosure and outreach.This document was written by Vijay Sarvepalli.

Vendor Information


American Megatrends Incorporated (AMI) Affected

Notified:  2024-04-17 Updated: 2024-07-09

Statement Date:   May 14, 2024

CVE-2018-25103 Affected

Vendor Statement

AMI has published an advisory to customers.

lighttpd Affected

Notified:  2024-04-17 Updated: 2024-07-09

Statement Date:   April 23, 2024

CVE-2018-25103 Affected

Vendor Statement

lighttpd 1.4.50 and earlier have a use-after-free-vulnerability which might leak memory. Brute force attacks would have to guess exact matches. Guesses must not contain chars < 0x20 and would have to rely on stable contents of a specific, non-attacker-controlled memory location. On system not processing any other requests, and therefore with more stable memory location, the contents in freed memory are very unlikely to contain anything sensitive. This bug is read-only and not otherwise directly exploitable, but could theoretically be leveraged if other exploitable bugs were found.


Intel Not Affected

Notified:  2024-04-17 Updated: 2024-07-09

Statement Date:   April 17, 2024

CVE-2018-25103 Not Affected

Vendor Statement

The only impacted Intel device is end of lifed. This was previously shared with Binarly. Due to it being EOL'd Intel will not be providing a mitigation.

CERT Addendum

Intel's products are Affected by this vulnerability however these products have been identified as end-of-life by Intel. Users should replace these end-of-life products as they will not be fixed by Intel.

Amazon Unknown

Notified:  2024-06-13 Updated: 2024-07-09

CVE-2018-25103 Unknown

Vendor Statement

We have not received a statement from the vendor.

Lenovo Unknown

Notified:  2024-04-17 Updated: 2024-07-09

CVE-2018-25103 Unknown

Vendor Statement

We have not received a statement from the vendor.

Other Information

CVE IDs: CVE-2018-25103
Date Public: 2024-07-09
Date First Published: 2024-07-09
Date Last Updated: 2024-07-10 18:25 UTC
Document Revision: 2

Sponsored by CISA.