Lighttpd: Denial of Service

Lighttpd: Denial of Service A vulnerability has been discovered in lighttpd which could result in denial of service. lighttpd 2022-10-31 2022-10-31 869890 remote 1.4.67 1.4.67

Lighttpd is a lightweight high-performance web server.

Lighttpd's mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received.

An attacker can trigger a denial of service via making Lighttpd try to call an uninitialized function pointer.

There is no known workaround at this time.

All lighttpd users should upgrade to the latest version:


          # emerge --sync
          # emerge --ask --oneshot --verbose ">=www-servers/lighttpd-1.4.67"

CVE-2022-37797 CVE-2022-41556 ajak ajak