CVE-2022-30780
Fixed in a distro release EPSS 57%
Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c has a typo that disrupts use of multiple read operations on large headers.
Products: lighttpd
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | lighttpd | 1.4.59-1 |
| Debian 13 | lighttpd | 1.4.59-1 |
| Debian 14 | lighttpd | 1.4.59-1 |
| Ubuntu Pro 16.04 LTS | lighttpd | no fix |