CVE-2025-12642: 
lighttpd vulnerability analysis and mitigation

CVE-2025-12642 is an HTTP Request Smuggling vulnerability in lighttpd 1.4.80 caused by the server incorrectly merging HTTP trailer fields into request headers after parsing. This behavior enables attackers to conduct HTTP Header Smuggling attacks, potentially bypassing access controls or injecting malicious input into backend systems. The vulnerability was reported by Toreon and published on November 3, 2025, with a patch committed on November 12, 2025. It carries a CVSS v3.1 base score of 9.1 (Critical) as assessed by NIST NVD, and a CVSS v4.0 base score of 6.9 (Medium) as assessed by the CNA Toreon (NVD, Red Hat CVE).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling). In lighttpd 1.4.80, a logic error in src/request.c caused the http_request_trailer_check function to fail to properly reject disallowed trailer fields — specifically, a missing call to light_bshift() meant that security-sensitive headers (e.g., Authorization, Cache-Control, Forwarded) sent as chunked-encoding trailers were incorrectly merged into the request headers visible to backend logic. The fix, contributed by researcher 'sebsrt', corrects the bitmask check to properly reject these trailers (GitHub Commit). The commit notes that lighttpd mod_proxy sends Connection: close to backends, which limits the ability to inject additional full requests, but trailers could still incorrectly modify headers and bypass configured policy checks (GitHub Commit).

Successful exploitation allows an unauthenticated remote attacker to bypass access control rules enforced on request headers, inject unsafe values into backend application logic that trusts those headers, and under certain conditions execute HTTP Request Smuggling attacks. The primary risks are to confidentiality and integrity — an attacker could access restricted resources or manipulate backend behavior — while availability is not directly impacted. Oracle Solaris 11.4 is also affected as lighttpd is a bundled third-party component (Oracle Bulletin, NVD).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of this report. The vulnerability is remotely exploitable without authentication and requires no user interaction, lowering the barrier for exploitation. The EPSS score is approximately 0.048%, indicating a currently low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available via Nessus (plugin 274352) and Qualys (plugin 296134).

1. Reconnaissance: Identify internet-facing lighttpd servers running version 1.4.80 using tools like Shodan or Censys, or by inspecting HTTP response headers (e.g., Server: lighttpd/1.4.80).
2. Craft malicious chunked request: Construct an HTTP/1.1 request using Transfer-Encoding: chunked that includes a chunked body followed by trailer fields containing security-sensitive headers (e.g., Authorization, Forwarded, or X-Forwarded-For) that would normally be blocked by access control policy.
3. Send the request: Transmit the crafted request to the vulnerable lighttpd server. Due to the logic error in http_request_trailer_check, the disallowed trailer fields are merged into the parsed request headers.
4. Bypass access control or inject into backend: The backend application or proxy receives the request with the attacker-controlled header values merged in, potentially granting access to restricted resources or altering backend logic that trusts those headers (e.g., IP allowlisting based on X-Forwarded-For, or authentication bypass via injected Authorization values) (GitHub Commit).

• Network: Unusual HTTP/1.1 POST or PUT requests with Transfer-Encoding: chunked containing trailer sections that include security-sensitive header names (e.g., Authorization, Forwarded, Cache-Control, WWW-Authenticate) after the chunked body terminator (0\r\n).
• Logs: lighttpd access logs showing requests with chunked transfer encoding to endpoints protected by header-based access controls, followed by unexpected successful responses (e.g., HTTP 200) that should have been denied.
• Application/Backend Logs: Backend application logs showing requests with unexpected or spoofed header values (e.g., internal IP addresses in X-Forwarded-For, unexpected Authorization tokens) originating from the lighttpd proxy.
• Process/Config: lighttpd version string reporting 1.4.80 in server headers or configuration files, indicating an unpatched deployment.

The vulnerability was introduced in lighttpd 1.4.80 and is fixed in lighttpd 1.4.81. Administrators should upgrade to lighttpd 1.4.81 or later as the primary remediation (GitHub Commit). Oracle Solaris 11.4 users should apply the patches referenced in the January 2026 Oracle Solaris Third Party Bulletin (SRU 90) (Oracle Bulletin). As a temporary workaround where upgrading is not immediately possible, consider placing a reverse proxy or WAF in front of lighttpd that strips or validates trailer fields before they reach the server, and restrict access to lighttpd instances to trusted networks only.

The vulnerability was discovered and reported by security researcher 'sebsrt', who published a technical blog post titled 'Trailing Danger' detailing the issue (sebsrt blog). The lighttpd maintainer acknowledged the contribution in the commit message and noted the limited exploitability in default configurations due to Connection: close behavior in mod_proxy. Red Hat and Oracle both tracked and addressed the vulnerability in their respective product advisories (Red Hat CVE, Oracle Bulletin).