HTTP Header Smuggling Vulnerability in lighttpd by Lighttpd Project

CVE-2025-12642

What is CVE-2025-12642?

A flaw in lighttpd version 1.4.80 allows improper handling of trailer fields that can be merged into HTTP headers post-request parsing. This vulnerability can be exploited by attackers to bypass access control mechanisms, inject unauthorized input into backend systems that rely on request header information, and execute HTTP Request Smuggling attacks under specific scenarios. Organizations using this version of lighttpd should assess their exposure to this issue and apply necessary mitigations.

References