Every CVE Search/ Get API key

CVE-2022-37797

In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid...

7.5 HighFix available

In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.60%Up 1.7 points since Sep 13, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.

Record
CVE-2022-37797
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.

Record
CVE-2022-37797
Updated
2026-11-02
EUVDEUVD-2022-40406 No score

In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.

Record
EUVD-2022-40406
Updated
2026-11-03
GitHub AdvisoriesGHSA-cm5p-p299-9f4g 7.5

In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid...

In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.

Record
GHSA-cm5p-p299-9f4g
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVOESA-2022-1989 7.5

lighttpd security update

Secure, fast, compliant and very flexible web-server which has been optimized for high-performance environments. It has a very low memory footprint compared to other webservers and takes care of cpu-load. Its advanced feature-set (FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many more) make it the perfect webserver-software for every server that is suffering load problems.

Security Fix(es):

In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.(CVE-2022-37797)

A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/1.1 chunked situations. Use of mod_fastcgi is, for example, affected. This is fixed in 1.4.67.(CVE-2022-41556)

Record
OESA-2022-1989
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-37797 7.5

In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.

Record
UBUNTU-CVE-2022-37797
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSV No score

In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.

Record
CVE-2022-37797
Updated
2026-11-02
OSVDEBIAN-CVE-2022-37797 No score

In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.

Record
DEBIAN-CVE-2022-37797
Updated
2026-11-03
OSVMGASA-2022-0369 No score

Updated lighttpd packages fix security vulnerability

In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition. (CVE-2022-37797)

A resource leak in mod_fastcgi and mod_scgi could lead to a denial of service after a large number of bad HTTP requests. (CVE-2022-41556)

Record
MGASA-2022-0369
Updated
2026-11-02
OSVopenSUSE-SU-2022:10132-1 No score

Security update for lighttpd

This update for lighttpd fixes the following issues:

lighttpd was updated to 1.4.66:

  • a number of bug fixes
  • Fix HTTP/2 downloads >= 4GiB
  • Fix SIGUSR1 graceful restart with TLS
  • futher bug fixes
  • CVE-2022-37797: null pointer dereference in mod_wstunnel, possibly a remotely triggerable crash (boo#1203358)
  • In an upcoming release the TLS modules will default to using stronger, modern chiphers and will default to allow client preference in selecting ciphers. “CipherString” => “EECDH+AESGCM:AES256+EECDH:CHACHA20:SHA256:!SHA384”, “Options” => “-ServerPreference” old defaults: “CipherString” => “HIGH”, “Options” => “ServerPreference”
  • A number of TLS options are how deprecated and will be removed in a future release: – ssl.honor-cipher-order – ssl.dh-file – ssl.ec-curve – ssl.disable-client-renegotiation – ssl.use-sslv2 – ssl.use-sslv3 The replacement option is ssl.openssl.ssl-conf-cmd, but lighttpd defaults should be prefered
  • A number of modules are now deprecated and will be removed in a future release: mod_evasive, mod_secdownload, mod_uploadprogress, mod_usertrack can be replaced by mod_magnet and a few lines of lua.

update to 1.4.65:

  • WebSockets over HTTP/2
  • RFC 8441 Bootstrapping WebSockets with HTTP/2
  • HTTP/2 PRIORITY_UPDATE
  • RFC 9218 Extensible Prioritization Scheme for HTTP
  • prefix/suffix conditions in lighttpd.conf
  • mod_webdav safe partial-PUT
  • webdav.opts += (“partial-put-copy-modify” => “enable”)
  • mod_accesslog option: accesslog.escaping = “json”
  • mod_deflate libdeflate build option
  • speed up request body uploads via HTTP/2
  • Behavior Changes
  • change default server.max-keep-alive-requests = 1000 to adjust
  • to increasing HTTP/2 usage and to web2/web3 application usage
  • (prior default was 100)
  • mod_status HTML now includes HTTP/2 control stream id 0 in the output
  • which contains aggregate counts for the HTTP/2 connection
  • (These lines can be identified with URL ‘*’, part of “PRI *” preface)
  • alternative: https://wiki.lighttpd.net/ModMagnetExamples#lua-mod_status
  • MIME type application/javascript is translated to text/javascript (RFC 9239)
Record
openSUSE-SU-2022:10132-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12327-1 No score

lighttpd-1.4.66-1.1 on GA media

These are all security issues fixed in the lighttpd-1.4.66-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12327-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
lighttpd
Debian:12
 before 1.4.66-1
1.4.66-1
lighttpd
Debian:13
 before 1.4.66-1
1.4.66-1
lighttpd
Debian:14
 before 1.4.66-1
1.4.66-1
lighttpd
Debian:10
 before 1.4.53-4+deb10u3, plus listed versions
1.4.53-41.4.53-4+deb10u11.4.53-4+deb10u1~bpo9+11.4.53-4+deb10u2
1.4.53-4+deb10u3
lighttpd
Debian:11
From an advisory covering 2 CVEs
 before 1.4.59-1+deb11u2, plus listed versions
1.4.59-11.4.59-1+deb11u1
1.4.59-1+deb11u2
lighttpd
Mageia:8
From an advisory covering 2 CVEs
 before 1.4.59-1.2.mga8
1.4.59-1.2.mga8
lighttpd
openEuler:20.03-LTS-SP1
From an advisory covering 2 CVEs
 before 1.4.67-1.oe1
1.4.67-1.oe1
lighttpd
openEuler:20.03-LTS-SP3
From an advisory covering 2 CVEs
 before 1.4.67-1.oe1
1.4.67-1.oe1
lighttpd
openEuler:22.03-LTS
From an advisory covering 2 CVEs
 before 1.4.67-1.oe2203
1.4.67-1.oe2203
lighttpd
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.4.53-4ubuntu21.4.54-2ubuntu11.4.55-1ubuntu11.4.55-1ubuntu1.20.04.11.4.55-1ubuntu1.20.04.2
 None known
Show 6 moreShow less
Affected packages
PackageAffectedFixed
lighttpd
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.4.59-1ubuntu21.4.59-1ubuntu31.4.63-1ubuntu11.4.63-1ubuntu21.4.63-1ubuntu31.4.63-1ubuntu3.1
 None known
lighttpd
SUSE:Package Hub 15 SP3
 before 1.4.66-bp154.2.3.1
1.4.66-bp154.2.3.1
lighttpd
SUSE:Package Hub 15 SP4
 before 1.4.66-bp154.2.3.1
1.4.66-bp154.2.3.1
lighttpd
openSUSE:Leap 15.3
 before 1.4.66-bp154.2.3.1
1.4.66-bp154.2.3.1
lighttpd
openSUSE:Leap 15.4
 before 1.4.66-bp154.2.3.1
1.4.66-bp154.2.3.1
lighttpd
openSUSE:Tumbleweed
 before 1.4.66-1.1
1.4.66-1.1

History

History
RecordedChangedSources
affected, factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-37797 is a high vulnerability (CVSS 7.5) in Lighttpd, published September 12, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.60%, the 85th percentile. Fixed in lighttpd 1.4.66-1.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open