Description

The http_request_split_value function in request.c in lighttpd before 1.4.32 allows remote attackers to cause a denial of service (infinite loop) via a request with a header containing an empty token, as demonstrated using the "Connection: TE,,Keep-Alive" header.

Remediation

References

CVE-2012-5533

Related Vulnerabilities

Jenkins Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-1812)

WordPress Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2016-6896)

Drupal Core 9.2.x Directory Traversal (9.2.0 - 9.2.1)

WordPress Plugin Paid Memberships Pro-Restrict Member Access to Content, Courses, Communities-Free or Paid Subscriptions Multiple Vulnerabilities (1.9.2.2)

e107 Other Vulnerability (CVE-2006-0682)

Severity

Medium

Classification

CVE-2012-5533

Tags

Missing Update Known Vulnerabilities