lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malicious HTTP GET request, as demonstrated by mishandling of /%2F? in burl_normalize_2F_to_slash_fix in burl.c.
CREATE(Triage): {Link=https://nvd.nist.gov/vuln/detail/CVE-2019-11072 User=admin}
