CVE-2011-4362
CVE-2011-4362 is a medium-severity vulnerability in Lighttpd with a CVSS 2.0 base score of 5.0. Its EPSS exploit-prediction score of 16% places it in the 97th percentile, indicating an elevated likelihood of exploitation.
Key facts
- Severity: Medium (CVSS 2.0 base score 5.0)
- EPSS exploit prediction: 16% (97th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Lighttpd
- Published:
- Last modified:
Description
Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.
Frequently asked questions
- What is CVE-2011-4362?
- Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.
- How severe is CVE-2011-4362?
- CVE-2011-4362 has a CVSS 2.0 base score of 5.0, rated medium severity.
- Is CVE-2011-4362 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 16% (97th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2011-4362?
- CVE-2011-4362 primarily affects Lighttpd. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2011-4362?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2011-4362 published?
- CVE-2011-4362 was published on 2011-12-24 and last updated on 2026-06-16.
References
- http://archives.neohapsis.com/archives/bugtraq/2011-12/0167.html
- http://blog.pi3.com.pl/?p=277
- http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2011_01.txt
- http://jvn.jp/en/jp/JVN37417423/index.html
- http://redmine.lighttpd.net/issues/2370
- http://secunia.com/advisories/47260
- http://www.debian.org/security/2011/dsa-2368
- http://www.exploit-db.com/exploits/18295
- http://www.openwall.com/lists/oss-security/2011/11/29/13
- http://www.openwall.com/lists/oss-security/2011/11/29/8
- http://www.securitytracker.com/id?1026359
- https://bugzilla.redhat.com/show_bug.cgi?id=758624
- https://exchange.xforce.ibmcloud.com/vulnerabilities/71536
Affected products (5)
- cpe:2.3:a:lighttpd:lighttpd:*:*:*:*:*:*:*:*
- cpe:2.3:a:lighttpd:lighttpd:1.5.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
More vulnerabilities in Lighttpd
- CVE-2019-11072 — Critical (CVSS 9.8): lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service…
- CVE-2014-2323 — Critical (CVSS 9.8): SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary…
- CVE-2025-12642 — Critical (CVSS 9.1): lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be…
- CVE-2007-3949 — High (CVSS 8.3): mod_access.c in lighttpd 1.4.15 ignores trailing / (slash) characters in the URL, which allows remote attackers to…
- CVE-2007-1870 — High (CVSS 7.8): lighttpd before 1.4.14 allows attackers to cause a denial of service (crash) via a request to a file whose mtime is 0,…
- CVE-2013-4559 — High (CVSS 7.6): lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which…
Threat intelligence
Threat-intel indicators referencing this CVE:
- 121.186.151.123 (ipv4-addr)
- 76.133.97.153 (ipv4-addr)
- 63.78.215.208 (ipv4-addr)
- 103.83.9.186 (ipv4-addr)
- 41.78.169.229 (ipv4-addr)
- 220.80.66.168 (ipv4-addr)
- 185.197.8.101 (ipv4-addr)
- 185.15.169.35 (ipv4-addr)