CVE-2019-11072

CVE-2019-11072 is a critical signed integer overflow vulnerability affecting lighttpd versions prior to 1.4.54. This flaw, specifically in the burl_normalize_2F_to_slash_fix function, can be triggered by a malicious HTTP GET request containing /%2F?, leading to a denial of service (application crash) if a specific, non-default feature introduced in lighttpd 1.4.50 is enabled. The vulnerability carries a CVSS score of 9.8 (CRITICAL), indicating a high-severity risk with a network-based attack vector, low attack complexity, and potential for high impact on confidentiality, integrity, and availability. While the developer states it is not exploitable beyond an explicit application abort, the high CVSS score reflects the potential for a complete service disruption. Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Despite the lack of exploit intelligence, the vulnerability has garnered significant community discussion, with 10 mentions, placing it in the top 1% of all CVEs for community attention.