CVE-2026-22903
Published: 09 February 2026
Description
An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffer overflow in the modified lighttpd server, causing it to crash and potentially enabling remote code execution due to…
more
missing stack protections.
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation patches the stack buffer overflow in the modified lighttpd server, directly preventing both DoS crashes and potential RCE from oversized SESSIONID cookies.
Memory protection mechanisms like stack canaries, ASLR, and DEP address the missing stack protections, blocking RCE even if the buffer overflow occurs.
Information input validation checks the length and format of SESSIONID cookies in HTTP requests, mitigating the trigger for the buffer overflow.
Security SummaryAI
CVE-2026-22903, published on 2026-02-09, is a stack buffer overflow vulnerability (CWE-121) affecting a modified version of the lighttpd web server. The issue arises when an unauthenticated remote attacker sends a crafted HTTP request containing an overly long SESSIONID cookie, triggering the overflow and causing the server to crash. Due to missing stack protections, this can potentially enable remote code execution. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical.
An unauthenticated attacker with network access to the affected server can exploit this vulnerability remotely with low complexity and no privileges or user interaction required. Exploitation leads to a denial-of-service condition by crashing the server, and the lack of stack protections raises the risk of full remote code execution, potentially allowing the attacker to gain control over the server.
Mitigation details are available in the advisory published by CERT VDE at https://certvde.com/de/advisories/VDE-2026-004.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack buffer overflow in public-facing lighttpd web server exploitable by unauthenticated remote attackers via crafted HTTP request, enabling potential RCE or DoS consistent with exploitation of public-facing applications.