Stack overflow

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of multiple D-Link routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the lighttpd service, which listens on TCP port 80 by default. The iss...

CVE-2022-41140

CVE-2022-41140 is a vulnerability in multiple D-Link routers (DIR-867, DIR-878, DIR-882) where the lighttpd service fails to validate the length of user-supplied data before copying to a fixed-length stack buffer. This allows network-adjacent attackers to execute arbitrary code with root privileg...

D-Link 多款路由器缓冲区错误漏洞

The D-Link DIR-878, among others, is a wireless router from China-based AUO D-Link. A security vulnerability exists in multiple D-Link routers, which stems from the lighttpd service used in the routers failing to validate the length of user input before copying it to a specific buffer. An attacke...

CVE-2022-41140

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of multiple D-Link routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the lighttpd service, which listens on TCP port 80 by default. The iss...

CVE-2022-41140

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of multiple D-Link routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the lighttpd service, which listens on TCP port 80 by default. The iss...

lighttpd < 1.4.54 Integer Overflow

According to its banner, the version of lighttpd running on the remote host is prior to 1.4.54. It is, therefore, affected by a signed integer overflow which might allow remote attackers to cause a denial of service. Note that the scanner has not tested for these issues but has instead relied onl...

lighttpd 1.4.56 < 1.4.59 Denial of Service

According to its banner, the version of lighttpd running on the remote host is 1.4.56, 1.4.57 or 1.4.58. It is, therefore, affected by a a denial of service because connectionreadheadermore in connections.c has a typo that disrupts use of multiple read operations on large headers. Note that the...

PT-2022-6574 · NetGear · Netgear Rax30

Name of the Vulnerable Software and Affected Versions: NETGEAR RAX30 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations. The flaw exists within the configuration of the lighttpd HTTP server, resulting from...

Lighttpd: Denial of Service

Background Lighttpd is a lightweight high-performance web server. Description Lighttpd's modwstunnel does not initialize a handler function pointer if an invalid HTTP request websocket handshake is received. Impact An attacker can trigger a denial of service via making Lighttpd try to call an...

GLSA-202210-12 : Lighttpd: Denial of Service

The remote host is affected by the vulnerability described in GLSA-202210-12 Lighttpd: Denial of Service - In lighttpd 1.4.65, modwstunnel does not initialize a handler function pointer if an invalid HTTP request websocket handshake is received. It leads to null pointer dereference which crashes...

OESA-2022-1989 lighttpd security update

Secure, fast, compliant and very flexible web-server which has been optimized for high-performance environments. It has a very low memory footprint compared to other webservers and takes care of cpu-load. Its advanced feature-set FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many more...

Mageia: Security Advisory (MGASA-2022-0369)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated lighttpd packages fix security vulnerability

In lighttpd 1.4.65, modwstunnel does not initialize a handler function pointer if an invalid HTTP request websocket handshake is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition. CVE-2022-37797 A...

MGASA-2022-0369 Updated lighttpd packages fix security vulnerability

In lighttpd 1.4.65, modwstunnel does not initialize a handler function pointer if an invalid HTTP request websocket handshake is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition. CVE-2022-37797 A...

The vulnerability of the mod_fastcgi and mod_scgi modules in the Lighttpd web server allows a hacker to cause a service failure.

The vulnerability of the modfastcgi and modscgi modules in the lighttpd web server is related to the lack of memory release when processing a large number of incorrect HTTP requests. Exploiting this vulnerability allows an attacker to cause service interruptions by sending HTTP requests...

Denial Of Service (DoS)

lighttpd is vulnerable to denial of service. The vulnerability exists in gwbackend.c where there is a resource leak which will lead to a connection slot exhaustion after a large amount of anomalous TCP behavior causing an application crash...

ROS-20221007-02

Vulnerability of lighttpd web server is related to memory leak in modfastcgi and modscgi modules while processing a large number of incorrect HTTP requests. a large number of malformed HTTP requests. Exploiting the vulnerability could allow an attacker, acting remotely, send multiple invalid HTTP...

CVE-2022-41556

A resource leak in gwbackend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service connection-slot exhaustion after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/1.1 chunked situations. Use of modfastcgi is, for example,...

ALPINE-CVE-2022-41556

A resource leak in gwbackend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service connection-slot exhaustion after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/1.1 chunked situations. Use of modfastcgi is, for example,...

DEBIAN-CVE-2022-41556

A resource leak in gwbackend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service connection-slot exhaustion after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/1.1 chunked situations. Use of modfastcgi is, for example,...