CVE-2026-22903 — Stack Overflow via SESSIONID Cookie in lighttpd

CVE-2026-22903

Stack Overflow via SESSIONID Cookie in lighttpd PUBLISHED

Description (CNA)

An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffer overflow in the modified lighttpd server, causing it to crash and potentially enabling remote code execution due to missing stack protections.

Affected (CNA)

Vendor / product	Versions
WAGO / 0852-1322	affected 0.0.0 through 2.64
WAGO / 0852-1328	affected 0.0.0 through 2.64
WAGO / 0852-1322	affected 2.64
WAGO / 0852-1328	affected 2.64

CWE

CWE-121

References

https://certvde.com/de/advisories/VDE-2026-004

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.