Embedded web server vulnerabilities in firmware: lighttpd, GoAhead, Boa and uhttpd

Five small servers account for most of what a firmware scan turns up on Linux-based devices. They differ less in their bugs than in who maintains them and how a fix reaches a device.

The lighttpd project page describes it as "a secure, fast, compliant, and very flexible web server" released "under the Open Source revised BSD license". The GoAhead README calls it "the most popular little embedded web server," says it "is used in millions of devices worldwide," and states that it "is actively supported and receives security updates as required, but will not have new features added." The Boa home page was last updated on 23 February 2005, and its own text calls Boa "the favorite web server in the embedded crowd." OpenWrt's uHTTPd documentation notes that on current releases "the uHTTPd webserver is both already installed and activated," with support for CGI, PHP, Perl and embedded Lua.

Four classes cover most published CVEs. The table lists representative records with exploitation data as of CISA KEV catalog version 2026.11.10 and FIRST EPSS scores dated 2026-11-12.

CGI handling

CGI is where an HTTP request turns into a process on the device, so it is where the worst server bugs land. CVE-2017-17562 is the reference case: the NVD record explains that GoAhead before 3.6.5 initialised "the environment of forked CGI scripts using untrusted HTTP request parameters," which, with the glibc dynamic linker, allows remote code execution through variables such as LD_PRELOAD. CVE-2021-42342 reopened the same path in GoAhead 4.x and 5.x before 5.1.5 through the file upload filter. In October and November 2026 Embedthis published further CGI advisories on GitHub: an ISINDEX query that injects command-line options into the CGI program, httpoxy HTTP_PROXY injection with a "non-functional environment blacklist," and two Windows-only CGI command and argument injections. lighttpd's 1.4.83 release lists "security: reject req header CGI conflicts" among its changes. Our command injection in embedded firmware guide covers the CGI programs themselves.

Request parsing

Embedded servers parse HTTP by hand, and length fields are the weak spot. OpenWrt advisory 2020-01-13-1 describes how uhttpd accepted a POST with "both Transfer-Encoding: chunked and a large Content-Length which exceeds 2^31 and is interpreted as a signed negative number," moving an internal buffer pointer to an invalid address; the fix shipped in OpenWrt 18.06.6 and 19.07.0. GoAhead 6.1.1 closed four request-smuggling advisories of the same family, and its release notes describe the result as "strict RFC 9112 request framing," with Content-Length combined with Transfer-Encoding rejected. lighttpd's 1.4.80 brought "stricter HTTP request/response header, trailer, and chunked validation/parsing" and detection of the HTTP/2 MadeYouReset attack (CVE-2025-8671), and 1.4.81 followed four days later with a single change: "security: fix to reject disallowed trailers."

Authentication bypass

Small servers implement their own login, sessions and password storage, and a single wrong comparison opens every protected page. GoAhead's advisory GHSA-qj3g-66fp-rhhr, fixed in 6.1.1, states that in 6.1.0 HTTP Basic and form authentication "accept any password for any user whose stored password is in the Blowfish (BF1:) salted-hash format," because the bcrypt result was "computed correctly and then immediately discarded." The same release fixed a session fixation flaw and a Digest nonce that disclosed the server secret. On devices, the more common bypass is in the route table or the vendor's handler, such as a page that checks the session in JavaScript only; our authentication bypass in embedded firmware guide covers those patterns.

Path traversal

Mapping a URL to a file is simple to write and easy to get wrong. CVE-2018-19052 allowed ../ traversal one directory above a lighttpd mod_alias target when the alias lacked a trailing slash but the target path had one, fixed in 1.4.50. The mini_httpd change history records for version 1.30: "Fix security bug that let remote users read arbitrary files," assigned CVE-2018-18778. Both depend on configuration and server version; our path traversal in embedded firmware guide covers the fix in vendor code.

Because they arrive inside chip-vendor SDKs, and the device maker's web interface is built on top of them. Microsoft Threat Intelligence's November 2022 report on vulnerable SDK components states that "despite being discontinued in 2005, the Boa web server continues to be implemented by different vendors across a variety of IoT devices and popular software development kits (SDKs)," and that its data "identified over 1 million internet-exposed Boa server components around the world over the span of a week." The same report adds that "while patches for the RealTek SDK vulnerabilities are available, some vendors may not have included them in their device firmware updates, and the updates do not include patches for Boa vulnerabilities."

Three forces keep Boa in place:

• The SDK owns the web stack. The SDK's setup pages, form handlers and CGI programs are written against Boa's internals. NVD's description of CVE-2021-35395 shows the pattern: the Realtek Jungle SDK ships "one based on Go-Ahead named webs and another based on Boa named boa," and the overflows sit in SDK handlers such as formRebootCheck.
• Many "Boa" CVEs are vendor CVEs. The NVD record for CVE-2017-9833 (/cgi-bin/wapopen on a camera) notes that multiple third parties call it a system-integrator issue "because Boa does not include any wapopen program," and the record for CVE-2021-33558 notes reports that it is "a site-specific issue." A newer Boa release would not fix them, and there is none.
• Nobody upstream publishes fixes. CVE-2009-4496, the log escape-sequence flaw Microsoft cites, has no fixed upstream release. Every fix is a local patch the device maker writes and keeps.

So a device maker with Boa in an image owns it like first-party code: patch it, test it, and plan its replacement with a maintained server.

Watch the right channel per server, because none of them uses the same one.

Two points need attention. First, GoAhead's security policy says "Security fixes are delivered in the current release only; earlier releases receive no backports," so a device on GoAhead 2.5, 3.x or 4.x carries every later fix as its own work. Second, lighttpd fixes can be silent. Binarly's BRLY-2024-002 advisory found lighttpd 1.4.45 in the BMC firmware of Intel's M70KLP series with an out-of-bounds read that lighttpd had fixed in 1.4.51 in 2018 without a CVE; the CVE, CVE-2018-25103, was assigned in June 2024, and Intel's PSIRT replied that the product was end of life. A version match is the only way to catch such a gap, so record exact versions.

Rank by reachability first, then by exploitation data, and use the CVSS base score only to break ties.

Check reachability. Does the server listen on WAN, or only on a management VLAN? OpenWrt's documentation warns that "by default, uHTTPd is bind to 0.0.0.0 which also includes the WAN port of your router." Is CGI enabled, and which programs are behind it? Is the vulnerable module, such as lighttpd mod_extforward for CVE-2022-22707, loaded at all?

Check exploitation data. A KEV listing moves a CVE to the top regardless of anything else; CVE-2017-17562 and CVE-2021-35395 are both listed, with EPSS scores above 0.97. Our KEV and EPSS prioritisation guide shows how the two combine.

Upgrade or patch. Move lighttpd to the latest 1.4.x release, GoAhead to 6.1.1 and uhttpd to a current OpenWrt package. For Boa, port the fix into your tree, and treat replacing it with a maintained server as part of the product's support plan. Check vendor backports before calling a version-matched CVE open; a distribution package or SDK may carry a patch without changing the version string.

Reduce what is exposed. GoAhead's own deployment notes list CGI, JavaScript templates, uploads and Digest authentication as "on by default," with build settings to remove each, and warn that the auto-login and legacy settings "must never be on in a shipped build." Bind every server to LAN or management interfaces, drop root after binding the port, remove sample CGI programs and test accounts, and hide version strings in the Server header.

Publish the decision. Use a VEX statement to mark CVEs that do not apply, for example a lighttpd mod_extforward CVE where the module is not loaded; our CSAF and VEX for device makers guide shows the format. Regenerate the SBOM, then confirm the new version shipped; our firmware diffing and patch analysis guide covers binary-level checks. The same method applies to other shared components: see our guides on BusyBox vulnerabilities, OpenSSL in embedded firmware and dnsmasq vulnerabilities.

SoftWSP's automated scan unpacks a firmware image, catalogs the components recorded in package databases such as opkg and dpkg, and matches each component's version against CVE records, CISA's KEV catalog and FIRST's EPSS scores. On an OpenWrt-based image, that is how lighttpd, its modules and uhttpd appear in the findings. This is deterministic code: the code scores, and AI narrates.

AI's part is the written explanation on top of that matching. It summarises which web server CVEs matched, which are KEV-listed or have a high EPSS score, and what the version evidence was, citing the component, version and record behind each sentence. An engineer reviews every finding before the report is delivered. The work this guide describes as manual stays with that engineer: finding GoAhead or Boa compiled into a vendor binary, which leaves no package record; mapping a uhttpd source date to fixes; checking which modules, CGI programs and listeners are active; and recording backports and "not affected" decisions.

For where web server review fits in a full assessment, see the OWASP Firmware Security Testing Methodology guide, or device & firmware security services to have a specific image reviewed.

This guide draws on lighttpd release notes and its advisory directory, the Embedthis GoAhead README, security policy, release notes and GitHub advisories, the Boa home page and source snapshot, the ACME Labs mini_httpd page, OpenWrt's uHTTPd documentation, advisory 2020-01-13-1, uhttpd git history and package Makefile, Binarly BRLY-2024-002, Microsoft Threat Intelligence's November 2022 report, NVD, CISA's KEV catalog (version 2026.11.10) and FIRST EPSS data dated 2026-11-12, all read directly on 2026-11-13.