CVE-2011-4362: Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth....

Security readout for executives and security teams

This is an older lighttpd web server flaw that can let a remote client crash the service by sending malformed Base64 data to HTTP authentication. The sourced impact is denial of service, not data theft or code execution. Businesses should care if legacy lighttpd versions are still exposed, especially on internet-facing authentication-protected sites. Exposure is most likely on legacy lighttpd deployments using HTTP authentication, particularly internet-facing servers. The bundle’s structured affected field is n/a, but the description and advisories identify affected lighttpd 1.4 and 1.5 development versions. Treat as a legacy exposure cleanup item with operational urgency where affected lighttpd still fronts important services. It is not KEV-listed in the bundle, but public exploit references and remote crash impact justify prompt remediation on exposed systems. Mitigation focus: Upgrade lighttpd 1.4 deployments to 1.4.30 or later.; Move lighttpd 1.5 development deployments to SVN revision 2806 or later.; Apply fixed distribution packages where vendor advisories provide backported patches..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.