Is it possible to have lighttpd for plone rather than Apache?

I did some research and it looks like Apache has a few thousand CVEs, whereas lighttpd seems to only have about 40, and half of those look like they are relatively minor.  From this cursory investigation, I conclude that lighttpd might be a better choice if security is a concern.

Am I right or wrong?  Can Plone even be implemented under lighty, or is Plone hardwired somehow to Apache?

One issue I already note is that the Plone configuration would have to be modified slightly because some of the options are Apache-specific (though I wonder if lighty actually might support those also).

Thanks.