CVE-2025-12642: HTTP Header Smuggling via Trailer Merge

Analyzed

AliasesUBUNTU-CVE-2025-12642

Published 03-11-2025Last modified 03-11-2025

Vulnerability summary

CVE-2025-12642 is a critical (CVSS 9.1) vulnerability in lighttpd. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 30.7% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

9.1/10

010

Critical · v3.1 (NVD)

EPSS score

0.37%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

03-11-2025
PublishedVulnerability first disclosed.
03-11-2025
Last modifiedVulnerability information updated.

Description

lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: * Bypass access control rules * Inject unsafe input into backend logic that trusts request headers * Execute HTTP Request Smuggling attacks under some conditions This issue affects lighttpd1.4.80

CVSS metrics

5 scores · 3 sources · 2 versions

v4.06.9v3.19.1

EPSS trend

Probability

0.37%

Chance of exploitation in the next 30 days

Percentile

31%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.37% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-444Inconsistent Interpretation of HTTP RequestsThe product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Lighttpd1 product

lighttpd≥ 1.4.80, < 1.4.81 | 1.4.80

Ubuntu1 product

lighttpdAll versions (No fix recorded)

2 vendors · 2 products

References

3 links