CVE-2025-12642

CRITICAL

lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow...

Affects 1 product across 1 vendor.

BCS5.86
CVSS 3.19.1
CVSS v46.9
EPSS0.3%
Percentile28th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, no availability impact.
CWE Weakness Definitions
CWE-444: CWE-444
Related Attack Patterns (CAPEC)
CAPEC-33 HTTP Request Smuggling
via CWE-444
CAPEC-273 HTTP Response Smuggling
via CWE-444

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ SAGE Intelligence — CITED Relevance Research Team

CVE-2025-12642 affects lighttpd 1.4.80 by incorrectly merging trailer fields into headers after HTTP request parsing, enabling HTTP Header Smuggling attacks.

BSID: BS-2025-GLOBAL-231410-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-12642?
CVE-2025-12642 affects lighttpd 1.4.80 by incorrectly merging trailer fields into headers after HTTP request parsing, enabling HTTP Header Smuggling attacks.
What is the CVSS score for CVE-2025-12642?
CVE-2025-12642 has CVSS 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS: 0.3%.
Is CVE-2025-12642 actively exploited?
No confirmed active exploitation of CVE-2025-12642 as of 2026-05-30.
How do I remediate CVE-2025-12642?
Priority: IMMEDIATE. Advisory: https://github.com/lighttpd/lighttpd1.4/commit/35cb89c103877de62d6b63d0804255475d77e5e1
What systems are affected by CVE-2025-12642?
CVE-2025-12642 affects: Lighttpd.
Vulnerability Details
CVE IDCVE-2025-12642
BSIDBS-2025-GLOBAL-231410-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Published2025-11-03
Last Modified2025-11-12
ICS Relevance0%
Weakness (CWE)
CWE-444
SourceNVD
Official Description

lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: * Bypass access control rules * Inject unsafe input into backend logic that trusts request headers * Execute HTTP Request Smuggling attacks under some conditions This issue affects lighttpd1.4.80

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability to bypass access control rules, inject unsafe input into backend logic that trusts request headers, and execute HTTP Request Smuggling attacks under certain conditions.

Exploitation Likelihood: HIGH

Affected Products
VendorProductFixed Version
Lighttpd Lighttpd —
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Threat Intelligence
● Threat Intelligence Validated: September 2026 | Threat Age: 317 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
SAGE Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashba2e3ec0b94a6ebcdab222e3b091f134e02c4ff6a315f2df79336fe0bfd0842cb97f48850f459995451d4414c05b07ccf609b2c2cebafa181454b6506b5247d1
Related CVEs affecting Lighttpd
CVE-2026-7546 9.8 A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B2... CVE-2026-22903 9.8 An unauthenticated remote attacker can send a crafted HTTP request containing... CVE-2014-2323 9.8 SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 al... CVE-2019-11072 9.8 lighttpd before 1.4.54 has a signed integer overflow, which might allow remot... CVE-2025-7574 9.8 A vulnerability, which was classified as critical, was found in LB-LINK BL-AC...
View all Lighttpd CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.1 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Check Your Assets Free →