CVE-2022-41556

🗓️ 06 Oct 2022 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 515 Views🌐 WEB

Resource leak in lighttpd 1.4.56-1.4.66 may cause denial of service via anomalous TCP behavior. Fixed in 1.4.67

Reporter	Title	Published	Views	Family All 45
ATTACKERKB	CVE-2022-41556	6 Oct 202218:17	–	attackerkb
AlpineLinux	CVE-2022-41556	6 Oct 202200:00	–	alpinelinux
Circl	CVE-2022-41556	6 Oct 202222:22	–	circl
CNNVD	lighttpd 安全漏洞	28 Sep 202200:00	–	cnnvd
Cvelist	CVE-2022-41556	6 Oct 202200:00	–	cvelist
Debian	[SECURITY] [DSA 5243-1] lighttpd security update	28 Sep 202216:05	–	debian
Debian CVE	CVE-2022-41556	6 Oct 202200:00	–	debiancve
Tenable Nessus	Debian DSA-5243-1 : lighttpd - security update	29 Sep 202200:00	–	nessus
Tenable Nessus	Fedora 35 : lighttpd (2022-c26b19568d)	23 Dec 202200:00	–	nessus
Tenable Nessus	GLSA-202210-12 : Lighttpd: Denial of Service	31 Oct 202200:00	–	nessus

NVD

Node

lighttpd lighttpdRange1.4.56–1.4.67

Node

Source	Link
github	www.github.com/lighttpd/lighttpd1.4/compare/lighttpd-1.4.66...lighttpd-1.4.67
github	www.github.com/lighttpd/lighttpd1.4/pull/115
security	www.security.gentoo.org/glsa/202210-12
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVOSBSCMLGCHH2Z74H64ZWVDFJFQTBC2/
git	www.git.lighttpd.net/lighttpd/lighttpd1.4/commit/b18de6f9264f914f7bf493abd3b6059343548e50

Parameter	Position	Path	Description	CWE
Transfer-Encoding	request body	/bus.php	CVE-2022-41556: resource exhaustion via anomalous chunked HTTP/1.1 requests to FastCGI gateway backends in lighttpd, leading to backend slot exhaustion and DoS.	CWE-401
chunked	request body	/bus.php	CVE-2022-41556: resource exhaustion via anomalous chunked HTTP/1.1 requests to FastCGI gateway backends in lighttpd, leading to backend slot exhaustion and DoS.	CWE-401

21 Nov 2024 07:23Current

7High risk

Vulners AI Score7

CVSS 3.17.5

EPSS0.01808