lighty labs

2026-10-26

GS 22:23 Lighttpd Bug #3323: "control frame size invalid" disconnects due to accessing wrong frame-octet

< 2 weeks gstrauss

MA 21:46 Lighttpd Bug #3323: "control frame size invalid" disconnects due to accessing wrong frame-octet

Hi
Very interesting case study to compare the finding against the AI result.
Do you have some ETA when there will be a lighttpd-1.4.86 ?
Thanks and
BR Stephan matrixstorm

GS 19:54 Lighttpd Bug #3329 (Duplicate): mod_wstunnel closes WebSocket connections with 1002 when receiving 2048-byte messages

Duplicate of #3323 gstrauss

WO 19:43 Lighttpd Bug #3329 (Duplicate): mod_wstunnel closes WebSocket connections with 1002 when receiving 2048-byte messages

After upgrading lighttpd from 1.4.82 to 1.4.85, WebSocket connections are unexpectedly closed with error code 1002 (Protocol Error) when the browser sends a text message that is >= 2048 bytes.
The same application works correctly with l... worrydream

GS 16:47 Lighttpd Feature #3328 (Invalid): Multiple SSL-based domains for the same IP address and same port?

@HippopotamusPerson Please read more carefully before posting.
Well, I should be more precise. Please *read*. You obviously have not even tried to read before posting. The lighttpd wiki (https://wiki.lighttpd.net) highlights in bol... gstrauss

AV 15:59 Lighttpd Feature #3328: Multiple SSL-based domains for the same IP address and same port?

Please post your question to the support forum instead: https://redmine.lighttpd.net/projects/lighttpd/boards/2
This bug report you filed will be closed as invalid. avij

HI 15:47 Lighttpd Feature #3328 (Invalid): Multiple SSL-based domains for the same IP address and same port?

I have some domain aliases for the same SSL-based IP address, and I want to be able to use lighttpd to access the same web pages for any url's referring to any of these domains.
I use LetsEncrypt, and I have pemfile and keyfile PEM fi... HippopotamusPerson

2026-10-24

GK 04:30 Lighttpd Bug #3327: mod_openssl false positive warning

gstrauss: I updated the wiki page for Secure HTTP (https://redmine.lighttpd.net/projects/lighttpd/wiki/Docs_SSL) with updated links to OpenSSL for the release strategy, latest info on the supported versions, and replaced the link to endo... gkloepfer

2026-10-23

GS 14:01 Lighttpd Bug #3327 (Patch Pending): mod_openssl false positive warning

Thank you for reporting this. Yes, the exact match is incorrect. Here is a patch: gstrauss

TO 12:57 Lighttpd Bug #3327 (Patch Pending): mod_openssl false positive warning

*Environment:*
* Hardware platform: ARMv7
* lighttpd version: 1.4.85
* OpenSSL version: 3.5.9
* Linux kernel version: 6.18.55
* Client: does not matter
*Configuration:* tomas.paukrt