CVE-2010-0295: lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, wh...

Security readout for executives and security teams

CVE-2010-0295 is a remote denial-of-service issue in lighttpd. Older versions allocate memory for every small read in a request, so slow fragmented requests can consume server memory and make hosted sites unavailable. This affects availability, not data confidentiality or integrity, based on the provided sources. Exposure is most likely where legacy lighttpd versions before 1.4.26, or 1.5.x builds, are reachable by untrusted clients. Internet-facing web servers and embedded appliances using old bundled lighttpd builds should be prioritized for inventory. Medium priority unless exposed systems support critical services. This is not described as data theft or code execution, but it can disrupt public websites and dependent services. Remediate exposed legacy lighttpd instances during the next security maintenance window, sooner for critical production paths. Mitigation focus: Upgrade lighttpd 1.4.x deployments to 1.4.26 or later.; For 1.5.x, follow official lighttpd patch or vendor package guidance.; Use distribution security updates where lighttpd is managed by the OS..

Prepared

Jun 28, 2026, 03:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.