HTTP Header Smuggling via Trailer Merge

published 2025-11-03 12 mo ago modified 2026-10-19 21 d ago also EUVD-2025-37517

cvss: 9.1; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 30%
public exploits: 0; none known

lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks.

Successful exploitation may allow an attacker to:

* Bypass access control rules * Inject unsafe input into backend logic that trusts request headers * Execute HTTP Request Smuggling attacks under some conditions

This issue affects lighttpd1.4.80

Patch / fix

fixed in 1 links 1

lighttpd lighttpd 1.4.81

github.com/lighttpd/lighttpd1.4@35cb89c commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-12642 updated 2025-11-21 cvss 5.3

lighthttpd: HTTP Header Smuggling via Trailer Merge

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 12 mo ago (2025-11-03)

Exploit prediction

0.37% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
CNA	4.0	6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

lighttpd lighttpd

Classification

Weakness

CWE-444 Inconsistent Interpretation of HTTP Requests

References

github.com /lighttpd/lighttpd1.4/commit/35cb89c103877de62d6b63d0804255475d77e5e1
patch

Sources

CVE List CVE-2025-12642
NVD CVE-2025-12642

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary