CVE-2019-11072: lighttpd signed integer overflow in URL normalization causes crash

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 9.8 and high EPSS with public exploit detail, but impact is limited to denial of service and only when a non-default feature is explicitly enabled.

What it is

lighttpd before 1.4.54 has a signed integer overflow in burl_normalize_2F_to_slash_fix in burl.c, triggered by a malicious HTTP GET request such as mishandling of /%2F?. The developer states the affected feature is new in 1.4.50 and is not enabled by default, requiring explicit configuration; when enabled, certain input triggers an abort() and application exit.

Impact

An attacker can cause a denial of service by crashing the lighttpd process. The developer states the flaw is not exploitable beyond triggering the explicit abort() with subsequent application exit, so no code execution or data compromise is demonstrated.

Attack surface

Reachable remotely over the network via an HTTP GET request to a lighttpd instance, with no authentication or user interaction required per the CVSS vector. However, the vulnerable feature must be explicitly enabled in the configuration, so default installations are not exposed.

Exploitation

Not listed in CISA KEV, but EPSS is high at 0.73762 (99.45th percentile) and references include an Exploit tag on the lighttpd issue tracker, indicating public proof-of-concept detail exists.

What to do

• Upgrade lighttpd to 1.4.54 or later, which contains the patch commit 32120d5b8b3203fc21ccb9eafb0eaf824bb59354.
• If the vulnerable URL normalization feature is not required, disable it in lighttpd.conf; the developer confirms it is not enabled by default.
• Review configurations for the feature introduced in 1.4.50 and remove or restrict it where possible.
• Monitor and rate-limit HTTP requests containing encoded slash sequences such as /%2F to reduce crash attempts.
• Run lighttpd under a supervisor that restarts the process to limit downtime from aborts.

Detection

• Search web server logs for HTTP GET requests containing /%2F or similar encoded slash patterns that precede crashes.
• Monitor for lighttpd process aborts or unexpected restarts correlated with inbound HTTP traffic.
• Alert on repeated requests from a single source targeting URL normalization edge cases.
• Check lighttpd version and configuration to confirm whether the affected feature is enabled.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.