CVE-2022-41556
Fixed in a distro release EPSS 4%
A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/1.1 chunked situations. Use of mod_fastcgi is, for example, affected. This is fixed in 1.4.67.
Products: lighttpd, fedoraproject fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.15 | lighttpd | 1.4.67-r0 |
| Alpine 3.16 | lighttpd | 1.4.67-r0 |
| Alpine 3.17 | lighttpd | 1.4.67-r0 |
| Alpine 3.18 | lighttpd | 1.4.67-r0 |
| Alpine 3.19 | lighttpd | 1.4.67-r0 |
| Alpine 3.20 | lighttpd | 1.4.67-r0 |
| Alpine 3.21 | lighttpd | 1.4.67-r0 |
| Alpine 3.22 | lighttpd | 1.4.67-r0 |
| Alpine 3.23 | lighttpd | 1.4.67-r0 |
| Alpine 3.24 | lighttpd | 1.4.67-r0 |
| Arch Linux | lighttpd | 1.4.67-1 |
| Debian 11 | lighttpd | 1.4.59-1+deb11u2 |
| Debian 12 | lighttpd | 1.4.67-1 |
| Debian 13 | lighttpd | 1.4.67-1 |
| Debian 14 | lighttpd | 1.4.67-1 |
| SUSE Package Hub 15 SP3 | lighttpd | 1.4.67-bp154.2.6.1 |
| SUSE Package Hub 15 SP4 | lighttpd | 1.4.67-bp154.2.6.1 |
| Ubuntu 20.04 LTS | lighttpd | 1.4.55-1ubuntu1.20.04.2 |
| Ubuntu 22.04 LTS | lighttpd | 1.4.63-1ubuntu3.1 |
| Ubuntu Pro 14.04 LTS | lighttpd | no fix |
| openSUSE Leap 15.3 | lighttpd | 1.4.67-bp154.2.6.1 |
| openSUSE Leap 15.4 | lighttpd | 1.4.67-bp154.2.6.1 |
| openSUSE Tumbleweed | lighttpd | 1.4.67-2.1 |