GCVE-1988-2026-0177

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "lighttpd2 Signedness Error",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "*Description:*\nA signedness vulnerability exists in the li_chunkqueue_append_mem()\nfunction in lighttpd2, where a signed length parameter (gssize len) is not\nproperly validated before being used in memory operations that expect an\nunsigned size. When a negative length value is supplied, it is implicitly\nconverted to a large unsigned value, resulting in an out-of-bounds memory\nread and a stack buffer overflow.\n\n*Affected Component:*\n\n   - Project: lighttpd2\n   - File: src/main/chunk.c\n   - Function: li_chunkqueue_append_mem()\n   - Affected versions: lighttpd2 2.0.0 (and likely earlier versions in the\n   2.x series)\n\n*Attack Vector:*\n\n   - Local / Internal API misuse\n   - Potential remote reachability if malformed HTTP request bodies,\n   chunked transfer decoding, or backend responses result in negative length\n   calculations that reach li_chunkqueue_append_mem().\n\n*Technical Details:*\n*The vulnerable function is defined as:*\nvoid li_chunkqueue_append_mem(liChunkQueue *cq, const void *mem, gssize\nlen);\n*Inside the function, len is only checked for zero:*\nif (!len) return; Negative values are not rejected. When a negative gssize\nvalue (e.g., -1) is passed, it is later used in calls that treat the value\nas an unsigned size (gsize), resulting in a large length such as\n4294967295. This causes unsafe memory operations via g_array_append_vals()\nand ultimately memcpy(), leading to an out-of-bounds memory access.\n\n*Proof of Concept:*\nA minimal reproducer demonstrates the issue:\n\n    /* Trigger signedness bug */\n    li_chunkqueue_append_mem(cq, buf, -1);\n\n# ./chunk\n\n*Output:*\n\n=================================================================\n==175485==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbff9cf00028 at pc 0xaaaae7908080 bp 0xffffc50ec5a0 sp 0xffffc50ebd90\nREAD of size 4294967295 at 0xfbff9cf00028 thread T0\n    #0 0xaaaae790807c in memcpy (/root/lighttpd2/chunk+0xd807c) (BuildId:\n5f4fb5aa4dacb9c02ca0afc9864a810d23e3629a)\n    #1 0xffff9fa9651c in g_array_append_vals\n(/lib/aarch64-linux-gnu/libglib-2.0.so.0+0x2651c) (BuildId:\nee842437cbb995404bc6e4a9a832449be696142c)\n    #2 0xffff9fdf2228 in li_chunkqueue_append_mem\n/root/lighttpd2/build-asan/../src/main/chunk.c:562:2\n    #3 0xaaaae794bb1c in main /root/lighttpd2/chunkqueue.c:9:5\n    #4 0xffff9f752598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n    #5 0xffff9f752678 in __libc_start_main csu/../csu/libc-start.c:360:3\n    #6 0xaaaae7864fac in _start (/root/lighttpd2/asan_test+0x34fac)\n(BuildId:\n\nRon Edgerson\nVulnerability Researcher & Exploit Developer\n\nCVE Research | Binary Exploitation | Application & Systems Security\nResponsible Disclosure • Proof-of-Concept Development\n\n🌐 https://github.com/ob1sec\n🔗 https://www.linkedin.com/in/ronedgerson1\n<https://linkedin.com/in/yourhandle>\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:25:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/14"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/14"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/14"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "lighttpd2 Signedness Error in li_chunkqueue_append_mem() Leads to Out-of-Bounds Memory Access",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0177",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/14",
            "automated": true,
            "contentSha256": "ce9ca537fc93737be7e2bf711a3fbdcd21411bd5cdcf6fd859abe2c6b4ad4348",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/14",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-30T23:47:44Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:25:42Z",
    "dateUpdated": "2026-09-08T07:25:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0177"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}