CVE Intelligence
Analysis AI-assisted

CVE-2026-22903: lighttpd (modified) stack buffer overflow via SESSIONID cookie

CVE-2026-22903 describes a stack-based buffer overflow in a modified build of the lighttpd web server, triggered by an overly long SESSIONID cookie in an HTTP request sent without authentication. The CNA rates it critical with a CVSS 3.1 base score of 9.8, and the record shows no CISA KEV listing. The record does not list affected versions or fixes.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-22903 is a stack-based buffer overflow (CWE-121) in a modified build of the lighttpd web server. According to the record, an unauthenticated remote attacker can trigger it with an HTTP request carrying an overly long SESSIONID cookie. The main vendor-side reference is the CERT VDE advisory VDE-2026-004.

Impact

  • Denial of service: the record states the server may crash.
  • Possible remote code execution: the record states this is potentially enabled by missing stack protections.
  • Confidentiality, integrity and availability: the CVSS 3.1 vector rates all three as High (C:H/I:H/A:H).

Affected products and versions

  • The record does not list any affected product versions, vendor names or product identifiers.
  • The description refers only to a modified lighttpd server. The record does not state whether the upstream lighttpd project is affected.

Exploitation status

  • The CISA KEV entry is marked as not listed in the record.
  • No confirmed exploitation appears in the sources consulted for this analysis.

Remediation and mitigation

  • Determine whether any deployed lighttpd instance is the modified build described in the advisory.
  • Review advisory VDE-2026-004 for guidance from the CNA. The record contains no fixed version.
  • Until a vendor fix is confirmed, consider limiting exposure of the affected service and placing it behind controls that restrict oversized request headers, such as a reverse proxy with header size limits. This is a general defensive measure, not a verified fix.
  • Enable platform-level memory protections where supported, since the advisory cites their absence as a factor.

Detection guidance

  • Monitor web server logs and service health for unexpected crashes or restarts of lighttpd.
  • Review inbound requests for unusually large cookie headers, particularly SESSIONID values, at the network edge or in logs.
  • Alert on abnormal process behavior or repeated service restarts that coincide with web traffic spikes.

Limitations of the available information

  • The record has no affected version ranges, fixed versions, or product and vendor fields.
  • The record source status is Deferred, so the data may change.
  • No independent technical analysis is included, and this analysis does not describe exploitation details.
  • The CVSS 3.1 score of 9.8 comes from the CNA, and the record contains no separate NVD score.

Frequently asked questions

What is CVE-2026-22903?

It is a stack-based buffer overflow in a modified build of the lighttpd web server, triggered by an overly long SESSIONID cookie in an HTTP request. The CNA rates it critical with a CVSS 3.1 score of 9.8.

Is this vulnerability being actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted for this analysis.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.