CVE-2022-37797

published 2022-09-12

CVE-2022-37797: In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null…

Priority P3 41 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	lighttpd	< lighttpd 1.4.66-1 (bookworm)	lighttpd 1.4.66-1 (bookworm)
lighttpd	lighttpd	—	—
lighttpd	lighttpd	>= 0 < 1.4.59-1+deb11u2	1.4.59-1+deb11u2
lighttpd	lighttpd	>= 0 < 1.4.66-1	1.4.66-1
lighttpd	lighttpd	>= 0 < 1.4.66-1	1.4.66-1
lighttpd	lighttpd	>= 0 < 1.4.66-1	1.4.66-1

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

osv 7.5 HIGH

vendor_debian 7.5 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-476