AMI MegaRAC SPx (embedded lighttpd web server): Use-after-free in the lighttpd request parser embedded in MegaRAC SPx

Impact

Use-after-free in the lighttpd request parser embedded in MegaRAC SPx. AMI rates the direct impact as minor - low confidentiality and availability effect via HTTP request smuggling. The reason it belongs on an operator's radar is not its score but what it proves: AMI was still shipping a 2018-era lighttpd in production BMC firmware in 2024, which tells you the embedded OSS stack in your BMCs (lighttpd, nginx, cURL, OpenSSL, busybox) is years behind and is not covered by whatever OS patching process you run on the host.

Who can reach it

Network access to the BMC's web server, unauthenticated but requiring a particular request shape and some user interaction. Reachable from anything that can hit the BMC's HTTP/HTTPS port.

What to do

Firmware flash to SPx_12.7+ / SPx_13.6, out-of-band per node, ODM-gated. Do not schedule a fleet flash for this CVE alone - its real use is as an argument for building BMC firmware version inventory. The durable action is to start tracking the running BMC build per node and the OSS components inside it, so the next embedded-library CVE is an inventory query rather than a research project.

References