lighttpd up to 1.4.66 TCP gw_backend.c denial of service

Summaryinfo

A vulnerability was found in lighttpd up to 1.4.66. It has been rated as problematic. Affected is an unknown function of the file gw_backend.c of the component TCP Handler. Performing a manipulation results in denial of service. This vulnerability is identified as CVE-2022-41556. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in lighttpd up to 1.4.66 (Web Server). This affects an unknown function of the file gw_backend.c of the component TCP Handler. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability. The summary by CVE is:

A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/1.1 chunked situations. Use of mod_fastcgi is, for example, affected. This is fixed in 1.4.67.

The weakness was released 10/06/2022 as 115. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2022-41556 since 09/26/2022. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 1.4.67 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch b18de6f9264f914f7bf493abd3b6059343548e50 is able to eliminate this problem. The bugfix is ready for download at git.lighttpd.net. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Web Server

Name

• lighttpd

Version

• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4
• 1.4.5
• 1.4.6
• 1.4.7
• 1.4.8
• 1.4.9
• 1.4.10
• 1.4.11
• 1.4.12
• 1.4.13
• 1.4.14
• 1.4.15
• 1.4.16
• 1.4.17
• 1.4.18
• 1.4.19
• 1.4.20
• 1.4.21
• 1.4.22
• 1.4.23
• 1.4.24
• 1.4.25
• 1.4.26
• 1.4.27
• 1.4.28
• 1.4.29
• 1.4.30
• 1.4.31
• 1.4.32
• 1.4.33
• 1.4.34
• 1.4.35
• 1.4.36
• 1.4.37
• 1.4.38
• 1.4.39
• 1.4.40
• 1.4.41
• 1.4.42
• 1.4.43
• 1.4.44
• 1.4.45
• 1.4.46
• 1.4.47
• 1.4.48
• 1.4.49
• 1.4.50
• 1.4.51
• 1.4.52
• 1.4.53
• 1.4.54
• 1.4.55
• 1.4.56
• 1.4.57
• 1.4.58
• 1.4.59
• 1.4.60
• 1.4.61
• 1.4.62
• 1.4.63
• 1.4.64
• 1.4.65
• 1.4.66

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion