Memory leak in lighttpd - CVE-2022-41556
Published: September 29, 2022
Vulnerability identifier: #VU67733
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2022-41556
CWE-ID: CWE-401
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
lighttpd
Debian Linux
Gentoo Linux
Fedora
Oracle Solaris
openEuler
Ubuntu
lighttpd (Ubuntu package)
lighttpd (Debian package)
www-servers/lighttpd
lighttpd
lighttpd-fastcgi
lighttpd-mod_mysql_vhost
lighttpd-debuginfo
lighttpd-mod_authn_gssapi
lighttpd-debugsource
lighttpd-mod_authn_pam
lighttpd-mod_authn_mysql
lighttpd-filesystem
lighttpd
Debian Linux
Gentoo Linux
Fedora
Oracle Solaris
openEuler
Ubuntu
lighttpd (Ubuntu package)
lighttpd (Debian package)
www-servers/lighttpd
lighttpd
lighttpd-fastcgi
lighttpd-mod_mysql_vhost
lighttpd-debuginfo
lighttpd-mod_authn_gssapi
lighttpd-debugsource
lighttpd-mod_authn_pam
lighttpd-mod_authn_mysql
lighttpd-filesystem
Detailed vulnerability description
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak within the mod_fastcgi and mod_scgi modules when handling a large number of incorrect HTTP requests. A remote attacker can send multiple incorrect HTTP requests to the web server and perform denial of service attack.
How to mitigate CVE-2022-41556
Install updates from vendor's website.