Denial of Service Vulnerability in lighttpd Web Server

CVE-2012-5533

What is CVE-2012-5533?

A vulnerability exists in the lighttpd web server that may allow a remote attacker to create a denial of service condition. Specifically, the function http_request_split_value in request.c prior to version 1.4.32 is susceptible to an attack involving a maliciously crafted HTTP request header. If an attacker sends a request containing an empty token in the header, such as 'Connection: TE,,Keep-Alive', this can lead to an infinite loop, causing the server to become unresponsive. Administrators are advised to upgrade to the latest version to mitigate this risk.

References