Critical vulnerability in lighttpd, DoS

From the official website of Security Announce: slow request DoS / OOM attack February 1st · 2010 Li Ming reported a serious bug in lighttpd: If you send the request data very slow (eg sleep 0.01 ...

Critical vulnerability in lighttpd, DoS

From the official site

Security Announce: slow request DoS / OOM attack
February 1st, 2010

Li Ming reported a serious bug in lighttpd:

If you send the request data very slow (eg sleep 0.01 after each byte), lighttpd will easily use all available memory and die (especially for parallel requests), allowing a DoS within minutes.

As far as we know all versions are affected.

Transfer

If you send data at large intervals (for example, pause 0.01 seconds after each byte), then Lighty will start to use all available memory and fill up (especially in the case of parallel requests), this allows you to organize a denial of service for several minutes.

As far as the developers know, all versions of the server contain a bug.

link to bug in tracker and patch
Prerelease 1.4.26 with fix (via eugeneorlov )
Fix for Debian (via esten )

Be careful!

Tags:

Tags

#From the official website of Security Announce: slow request DoS / OOM attack February 1st #2010 Li Ming reported a serious bug in lighttpd: If you send the request data very slow (eg sleep 0.01 ...

Read Next

Battleship Library in Python: Field and Ship Classes

Battleship Library in Python: Field and Ship Classes

Analysis of the architecture of the Battleship game logic library in Python. Field, Ship classes, coordinate validation, ship placement. Code examples and error refactoring for middle developers. Study the implementation.

ClickHouse aggregate functions: uniqHLL12, quantileTDigest, topK

ClickHouse aggregate functions: uniqHLL12, quantileTDigest, topK

uniqHLL12 for fast unique users, quantileTDigest for distributions, groupArray, topK, -If combinators. Examples of GGR, cohorts, retention.

Prompt Engineering for LLM: Production Techniques | Guide

Prompt Engineering for LLM: Production Techniques | Guide

How to Make LLM Services Work Predictably? XML Isolation, Negative Constraints, and Format Forcing Techniques for Production. Read the Guide.

FSTEC Order No. 117: GIS protection and IB measures

FSTEC Order No. 117: GIS protection and IB measures

Analysis of FSTEC Order No. 117: process approach, Kzi/Pzi metrics, vulnerability measures and PAM. Transition plan from No. 17 for GIS and government agencies. Study the requirements for compliance.

Data analyst from scratch: free training plan

Data analyst from scratch: free training plan

Master data analytics for free: stages, Python, SQL, Excel. Step-by-step guide for junior level. Start a data analyst career in 4–6 months — build a portfolio and look for a job.

Precise LLM Arithmetic via Code

Precise LLM Arithmetic via Code

Learn how to achieve 100% accuracy in LLM calculations: generate Python code instead of direct computations. Real examples, Docker sandbox, error handling. For developers.

Gesture Controller 3x3 for Smart Home

Gesture Controller 3x3 for Smart Home

Learn how the 3x3 matrix on TTP223 solves the problem of multiple commands without a screen. Prototype, CLI debugging, scenarios. Integrate into your smart home.

Rhadamanthys vulnerability: how damage was reduced

Rhadamanthys vulnerability: how damage was reduced

A vulnerability in the Rhadamanthys infostealer panel allowed researchers to temporarily track stolen data and alert victims. Learn about the limitations of the private sector in combating cybercrime.

Xynova Flex 2: robotic hand with reflexes and 23 degrees of freedom

Xynova Flex 2: robotic hand with reflexes and 23 degrees of freedom

Chinese Xynova introduced the robotic hand Flex 2 with reflexes and 23 degrees of freedom. Learn how this will change the robotics market by 2032.

Caterpillar: Physical AI on Construction Sites with Nvidia Thor

Caterpillar: Physical AI on Construction Sites with Nvidia Thor

Caterpillar and Nvidia presented at CES 2026 autonomous heavy equipment with an AI assistant. Machines think offline and reduce accident rates. Learn about digital construction.