CVE-2025-12642 HTTP Header Smuggling via Trailer Merge
Attackers can bypass access controls and inject malicious headers via HTTP header smuggling in lighttpd, potentially leading to backend logic manipulation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12642?
CVE-2025-12642 is a medium-severity vulnerability in lighttpd, published on 3 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks.
Successful exploitation may allow an attacker to:
* Bypass access control rules * Inject unsafe input into backend logic that trusts request headers * Execute HTTP Request Smuggling attacks under some conditions
This issue affects lighttpd1.4.80
Weakness: CWE-444
Which versions are affected by CVE-2025-12642?
It affects 1 product.
Products include Lighttpd Lighttpd.
How do I fix CVE-2025-12642?
No fix has been published for CVE-2025-12642 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-12642 being exploited?
There is no known exploitation of CVE-2025-12642 in the wild and no public exploit code.
Other vulnerabilities in lighttpd
Sources
Also known as GHSA-fvx8-q97q-cw73, UBUNTU-CVE-2025-12642.