Vulnerability · Published Nov 3, 2025 · Assigned by Toreon
CVE-2025-12642HTTP Header Smuggling via Trailer Merge
Medium 6.9
In plain English
A medium-severity security flaw in lighttpd from lighttpd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Official description
lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: * Bypass access control rules * Inject unsafe input into backend logic that trusts request headers * Execute HTTP Request Smuggling attacks under some conditions This issue affects lighttpd1.4.80
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | lighttpd | no fix listed | UBUNTU-CVE-2025-12642 |
| Ubuntu:24.04:LTS | lighttpd | no fix listed | UBUNTU-CVE-2025-12642 |
| Ubuntu:25.10 | lighttpd | no fix listed | UBUNTU-CVE-2025-12642 |
| Ubuntu:26.04:LTS | lighttpd | no fix listed | UBUNTU-CVE-2025-12642 |
| Ubuntu:26.10 | lighttpd | no fix listed | UBUNTU-CVE-2025-12642 |
Affected products (as reported)
Weakness: CWE-444 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N