Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Lighttpd server crashes from overly long cookie, potentially allowing code execution

CVE-2026-22903 · published 8 months ago
Summary

A malicious actor can send a specially crafted cookie to a vulnerable lighttpd server, causing it to crash. This could potentially allow the attacker to execute unauthorized code on the server. To fix, update to a version of lighttpd that includes stack protections.

Original advisory text
An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffer overflow in the modified lighttpd server, causing it t...
An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffer overflow in the modified lighttpd server, causing it to crash and potentially enabling remote code execution due to missing stack protections.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published9 Feb 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2026-22903 · NVD
Track software like this
Free during beta