CVE-2008-0983 Denial of service in n/a

What is CVE-2008-0983?

CVE-2008-0983 is a medium-severity denial of service vulnerability in n/a, published on 26 Feb 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

lighttpd 1.4.18, and possibly other versions before 1.5.0, does not properly calculate the size of a file descriptor array, which allows remote attackers to cause a denial of service (crash) via a large number of connections, which triggers an out-of-bounds access.

Weakness: CWE-399

Which versions are affected by CVE-2008-0983?

It affects 1 product.

Products include Lighttpd Lighttpd.

How do I fix CVE-2008-0983?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2008-0983 being exploited?

There is no known exploitation of CVE-2008-0983 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2019-11072 Integer overflow in n/a Critical 9.8
• CVE-2007-3949 Security feature bypass in n/a High 8.3
• CVE-2007-1870 Null dereference in n/a High 7.8
• CVE-2022-30780 Denial of service in n/a High 7.5
• CVE-2025-12642 HTTP Header Smuggling via Trailer Merge Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2008-0983, DSA-1609-1, GHSA-fxrf-v868-58jw.