CVE-2026-22903
9.8 CRITICALPublished 2026-02-09 · Modified 2026-02-09 · Awaiting Analysis
Quick Summary
A critical vulnerability in a modified version of the lighttpd web server allows an unauthenticated attacker on the network to crash the server or potentially take control of it by sending a specially crafted web request with a very long session cookie.
Who is affected
This affects systems running the vulnerable version of lighttpd. An attacker could cause a denial of service or execute arbitrary code on the server, compromising it completely.
Recommended fix
Apply the vendor-provided patch immediately. If a patch is not available, consider implementing a web application firewall (WAF) rule to block excessively long SESSIONID cookies as a temporary mitigation.
Technical Description
An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffer overflow in the modified lighttpd server, causing it to crash and potentially enabling remote code execution due to missing stack protections.
CVSS Details
Attack Vector
NETWORK
Complexity
LOW
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-121