Lighttpd

you need read permission to execute a file.

No you don't. Please try this for yourself if you don't believe me:

$ cat test.c
#include <stdio.h>
int main(void) {
puts("Hello World");
return 0;
}

$ gcc -otest test.c
$ chmod 0111 test
$ ./test
Hello World

Yes, you can execute "not readable" files, although it is useless if you don't set SUID also (without SUID you can just LD_PRELOAD anything you want).

The open() is from our stat code; i don't intend to change the semantics of it, so you have to live with the current behaviour - just provide a readable wrapper script (and perhaps replace SUID with sudo):

#!/bin/sh

exec /path/to/real/binary

Fixed in lighttpd 1.4.42 released way back in 2016.
https://git.lighttpd.net/lighttpd/lighttpd1.4/commit/b9f245f2633a831ce1a83b2c01b67718f9f91301