Total vulnerabilities in the database
The http_request_split_value function in request.c in lighttpd before 1.4.32 allows remote attackers to cause a denial of service (infinite loop) via a request with a header containing an empty token, as demonstrated using the "Connection: TE,,Keep-Alive" header.
| Software | From | Fixed in |
|---|---|---|
| lighttpd / lighttpd | 1.4.32 | 1.4.32.x |
| lighttpd / lighttpd | 1.4.31 | 1.4.31.x |