Skip to content
Sign in
9.8 Critical

CVE-2026-22903 An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie

Description

An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffer overflow in the modified lighttpd server, causing it to crash and potentially enabling remote code execution due to missing stack protections.

Affected products and versions

Product Affected versions Fixed in
0852-1322 2.64 No fix stated
0852-1328 2.64 No fix stated

Other CVEs of 0852-1322

The 4 CVEs of 0852-1322 →
CVE-2026-22906 User credentials are stored using AES‑ECB encryption with a hardcoded key 9.8 Critical CVE-2026-22905 An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and using path… 7.5 High CVE-2026-22904 Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote… 9.8 Critical
Track this CVE