CVE-2026-22904 — Stack Overflow via Oversized Cookie Fields in lighttpd

CVE-2026-22904

Stack Overflow via Oversized Cookie Fields in lighttpd PUBLISHED

Description (CNA)

Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversized cookie values and trigger a stack buffer overflow, resulting in a denial‑of‑service condition and possible remote code execution.

Affected (CNA)

Vendor / product	Versions
WAGO / 0852-1322	affected 0.0.0 through 2.64
WAGO / 0852-1328	affected 0.0.0 through 2.64
WAGO / 0852-1322	affected 2.64
WAGO / 0852-1328	affected 2.64

CWE

CWE-121

References

https://certvde.com/de/advisories/VDE-2026-004

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.