CVE-2018-25103

Vulnerability

Overview

A use-after-free vulnerability exists in lighttpd versions 1.4.50 and earlier, within the HTTP request parser. The bug occurs when handling folded (continuation) headers: after headers are combined, some internal pointers become stale, leading to reads from freed or invalid memory during the same request [3]. The root cause was an oversight in how data_string pointers were reused after header folding operations, as seen in the patch that introduced proper tracking (current_header) and cleaned up the folding logic [4].

Exploitation

Prerequisites

An unauthenticated attacker can trigger this vulnerability remotely by sending crafted HTTP requests with folded headers. No authentication or special network position is required (CVSS v3.1 score 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) [2]. The attack surface includes any device or system running a vulnerable lighttpd version, which has historically been embedded in numerous IoT devices and baseboard management controllers (BMCs) from vendors such as AMI, Intel, and Lenovo [2][3].

Impact

A successful exploit can lead to two primary outcomes: (1) information disclosure – the server may leak memory contents that could reveal sensitive data, and (2) denial of service – the process can crash due to reading invalid pointers [1][3]. The original disclosure by VDOO in 2018 emphasized the DoS risk, while later analysis by Binarly in 2024 highlighted the information leak potential through string comparison against stale pointers [1][2].

Mitigation

Status

The lighttpd project fixed this vulnerability in version 1.4.51, released in August 2018 [1][3]. The patch is available in commit df8e4f95614e476276a55e34da2aa8b00b1148e9 [4]. However, many products still ship vulnerable versions, creating a supply-chain risk. Organizations are advised to upgrade to lighttpd >=1.4.51 and verify that embedded devices are updated. A CVE ID was only assigned in 2024 (CVE-2018-25103) after the vulnerability was found to still be present in numerous systems [3].