CVE-2025-12642 - CVE House
Back to Database
Status published Medium CVE-2025-12642

HTTP Header Smuggling via Trailer Merge

Vulnerability Description

lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: * Bypass access control rules * Inject unsafe input into backend logic that trusts request headers * Execute HTTP Request Smuggling attacks under some conditions This issue affects lighttpd1.4.80

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-12642

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Sebastiano Sartor <@sebsrt>

References

More from lighttpd

View All →
CVE-2022-41556
A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66...
High 7.5
CVE-2022-37797
In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function...
High 7.5
CVE-2022-30780
Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause...
High 7.5
CVE-2022-22707
In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the...
Medium 5.9
CVE-2019-11072
lighttpd before 1.4.54 has a signed integer overflow, which might...
Critical 9.8

Affected Vendor

Affected Software

lighttpd
Vulnerable Versions:
1.4.80

Timeline

Official Publish: November 3rd, 2025
Last Modified: November 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-444

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1565.002 Stored Data Manipulation
Impact
T1078 Valid Accounts
Defense Evasion