Skip to content

Home

  • in releases
  • 2 min read

1.4.32

Important changes

One important denial of service (in 1.4.31) fix: CVE-2012-5533.

Downloads

External references

1.4.31 - Diablo servers are down again, back to work

Important changes

Many important changes - fixed a segfault (crash on first https request), disabled mmap due to possible crash if the file is truncated while reading and more.

If you still want to use mmap you can use ./configure --enable-mmap, but check #2391 before.

Downloads

  • in releases
  • 2 min read

1.4.30 - Faster than santa, your first present this year!

And lighttpd 1.4 is still alive :)

Especially for ssl users this release should be important: by setting

ssl.cipher-list = "ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4-SHA:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM"

you can mitigate BEAST attacks.\ Also check your site with Qualys SSL Labs Server Test

Important changes

  • [mod_auth] Fix signedness error in http_auth (CVE-2011-4362)
  • ssl: disable client initiated renegotiations
  • ssl: support mitigating BEAST attack
  • fix connection stalls

Downloads

In the comments for 1.4.29 we were asked for a launchpad repository for ubuntu. This is not going to happen (launchpad sucks), but we have repositories for some dists on build.opensuse.org.\ Checkout GetLighttpd, or server:http/lighttpd or home:stbuehler/lighttpd on build.opensuse.org.\

1.4.29

Important changes

  • solve name conflict of md5 functions with OpenSSL lib
  • mod_proxy, mod_cgi and other mod_*cgi fixes
  • ssl improvements
  • Native solaris ports fdevent handler “solaris-eventports”

Downloads

  • in releases
  • 1 min read

1.4.28

1.4.27 introduced some serious bugs in our fdevent system; one resulted in segfaults with FreeBSD; this should be fixed now.

Downloads

  • in releases
  • 2 min read

1.4.27 - P != NP for N != 1 and P != 0

It has been a long time since the last release again, and again we have many bug fixes - and some small new features, check the following summary or the complete list below.

There have been fixes for ssl (SNI handling and the SSL_CTX_set_options fix) and mod_cgi and mod_proxy (response handling).

There is a new fdevent handler “libev”; “linux-rtsig” got removed.

And we bind now IPv6 sockets to IPv6 only in almost all cases (we disable “dual-stack”), see IPv6-Config for details.

Downloads

  • in releases
  • 1 min read

1.4.26 - Chinese dragon

There have been some important bug fixes (request parser handling for splitted header data, a fd leak in mod_cgi, a segfault with broken configs in mod_rewrite/mod_redirect, HUP detection and an OOM/DoS vulnerability)

Downloads

  • in releases
  • 1 min read

Security Announce: slow request DoS/OOM attack

Li Ming reported a serious bug in lighttpd:

If you send the request data very slow (e.g. sleep 0.01 after each byte), lighttpd will easily use all available memory and die (especially for parallel requests), allowing a DoS within minutes.

See:

The bug is tracked as CVE-2010-0295.

As far as we know all versions are affected.

  • in releases
  • 1 min read

1.4.25 - the slogan is a lie

We did some important bug fixes (some of them new since 1.4.24, and some older bugs). Only 2 small new features: traceback for lua errors and the SSL_CLIENT_* vars export for ssl client cert validation.

Downloads

  • in releases
  • 3 min read

1.4.24 - now with TLS SNI and money back guarantee

Update: There is a small regression in mod_magnet, see #1307

We finally added TLS SNI, and many other small improvements. We also fixed pipelining (that should fix problem with lighty as debian mirror) and some mod_fastcgi bugs - this should result in improved handling of overloaded and crashed backends (you know which one :D).

Important changes

  • Connection state handling (pipelining should work now)
  • FastCGI fixes: improved disabled-time handling, fixed bug in active-backends counter.
  • TLS SNI support

Downloads