Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-22904

Stack Overflow via Oversized Cookie Fields in lighttpd

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversized cookie values and trigger a stack buffer overflow, resulting in a denial‑of‑service condition and possible remote code execution.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WAGO 0852-1322

Default version status: unaffected

  • 0.0.0 to ≤ 2.64affected

WAGO 0852-1328

Default version status: unaffected

  • 0.0.0 to ≤ 2.64affected

WAGO 0852-1322

Default version status: unaffected

  • 2.64affected

WAGO 0852-1328

Default version status: unaffected

  • 2.64affected

References