CVE-2010-0295
- State
- Published
- Severity
- Not scored
- Published
- Feb 3, 2010
- Updated
- Aug 7, 2024
- Reserved
- Jan 12, 2010
Description
lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 38403third-party-advisory
- http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2711
- ADV-2011-0172vdb-entry
- 39765third-party-advisory
- http://redmine.lighttpd.net/issues/2147
- http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2010_01.txt
- FEDORA-2010-7643vendor-advisory
- lighttpd-slow-request-dos(56038)vdb-entry
- http://blogs.sun.com/security/entry/cve_2010_0295_vulnerability_in
- FEDORA-2010-7636vendor-advisory
- DSA-1987vendor-advisory
- SUSE-SR:2010:003vendor-advisory
- http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow_request_dos.patch
- http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2710
- 38036vdb-entry
- http://download.lighttpd.net/lighttpd/security/lighttpd-1.5_fix_slow_request_dos.patch
- [oss-security] 20100202 lighttpd: slow request dos/oom attack [CVE-2010-0295]mailing-list
- FEDORA-2010-7611vendor-advisory
- GLSA-201006-17vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.