Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

lighttpd/lighttpd1.4

              master @ 2ddc513
            

134

Fixes

CVEs

CRITICAL

Peak severity

28.9%

Coverage

Highlights

Auth Bypass: 23 prior fixes. Scrutinize any change in this area.

src/mod_proxy.c: most-fixed (22 issues). Treat as high-risk during review.

75 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Recurring authentication bypasses across Digest parsing, nonce validation, URI/realm checks, and trust-boundary handling in extforward and TLS client-cert verification. Each fix closed a specific gap, but the pattern suggests systemic weaknesses in parsing and state management.

Request Smuggling: Frequent smuggling fixes around message framing: Content-Length parsing, Transfer-Encoding handling, header forwarding (Expect, Proxy-Connection), and response boundary tracking. These are high-severity because they enable request desynchronization between frontend and backend.

Denial of Service: HTTP/2 rapid reset and header-discard DoS, plus multiple crash bugs in digest auth (base64, qop, NULL derefs) and ALPN parsing. These are remotely triggerable and repeatedly patched, indicating ongoing resource-exhaustion and input-validation gaps.