CVE-2022-41556 — Missing Release of Memory after Effective Lifetime in Lighttpd

CWE-401 — Missing Release of Memory after Effective Lifetime7 documents6 sources
Severity
7.5HIGHNVD
OSV5.9
EPSS
1.8%
top 17.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
LighttpdDebian LighttpdFedoraproject Fedora
Timeline
PublishedOct 6
Latest updateFeb 15

Description

A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/1.1 chunked situations. Use of mod_fastcgi is, for example, affected. This is fixed in 1.4.67.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/lighttpd< lighttpd 1.4.67-1 (bookworm)
▶NVDlighttpd/lighttpd1.4.56 — 1.4.67
▶Debianlighttpd/lighttpd< 1.4.59-1+deb11u2+3
▶Ubuntulighttpd/lighttpd< 1.4.55-1ubuntu1.20.04.2+1

Also affects: Fedora 35

Patches

Patch: git.lighttpd.net ↗Patch: git.lighttpd.net ↗

🔴Vulnerability Details

3
OSV
lighttpd vulnerabilities↗2023-02-28
▶
OSV
CVE-2022-41556: A resource leak in gw_backend↗2022-10-06
▶
GHSA
GHSA-jm88-vr5q-23rj: A resource leak in gw_backend↗2022-10-06
▶

📋Vendor Advisories

3
CISA ICS
Siemens SCALANCE XCM-/XRM-300↗2024-02-15
▶
Ubuntu
lighttpd vulnerabilities↗2023-02-28
▶
Debian
CVE-2022-41556: lighttpd - A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to ...↗2022
▶