{"id":"CVE-2022-37797","aliases":["DEBIAN-CVE-2022-37797","DLA-3133-1","DSA-5243-1","EUVD-2022-40406","GHSA-cm5p-p299-9f4g","MGASA-2022-0369","OESA-2022-1989","UBUNTU-CVE-2022-37797","openSUSE-SU-2022:10132-1","openSUSE-SU-2024:12327-1"],"status":"published","title":"In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid...","description":"In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02604,"percentile":0.85485,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2022-09-12T00:00:00Z","modified":"2026-11-03T06:02:56Z","fixes":[{"ecosystem":"Debian:12","package":"lighttpd","fixed_in":["1.4.66-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lighttpd","fixed_in":["1.4.66-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lighttpd","fixed_in":["1.4.66-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"lighttpd","fixed_in":["1.4.53-4+deb10u3"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"lighttpd","fixed_in":["1.4.66-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"lighttpd","fixed_in":["1.4.66-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"lighttpd","fixed_in":["1.4.66-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"lighttpd","fixed_in":["1.4.66-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"lighttpd","fixed_in":["1.4.66-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.66-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.66-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.66-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.53-4+deb10u3"}]}],"versions":["1.4.53-4","1.4.53-4+deb10u1","1.4.53-4+deb10u1~bpo9+1","1.4.53-4+deb10u2"]},{"source":"osv","ecosystem":"Debian:11","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.59-1+deb11u2"}]}],"versions":["1.4.59-1","1.4.59-1+deb11u1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.59-1.2.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.67-1.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.67-1.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.67-1.oe2203"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.53-4ubuntu2","1.4.54-2ubuntu1","1.4.55-1ubuntu1","1.4.55-1ubuntu1.20.04.1","1.4.55-1ubuntu1.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.59-1ubuntu2","1.4.59-1ubuntu3","1.4.63-1ubuntu1","1.4.63-1ubuntu2","1.4.63-1ubuntu3","1.4.63-1ubuntu3.1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.66-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.66-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.66-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.66-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.66-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"lighttpd","product":"lighttpd"}],"references":[{"url":"https://redmine.lighttpd.net/issues/3165","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","web","report"]},{"url":"https://www.debian.org/security/2022/dsa-5243","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00002.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://security.gentoo.org/glsa/202210-12","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37797","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cm5p-p299-9f4g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/37xxx/CVE-2022-37797.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-37797","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0369.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30912","tags":["report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1989","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41556","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-37797","tags":["report"]},{"url":"https://git.lighttpd.net/lighttpd/lighttpd1.4/commit/971773f1fae600074b46ef64f3ca1f76c227985f","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-37797","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ATUOJQDWIRALBMVI5GOSOGPZP5AWVAZF/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1203358","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-37797","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-37797","description":"In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.","status":"published","published":"2022-09-12T00:00:00Z","modified":"2024-08-03T10:37:41.657Z","updated_at":"2026-11-02T14:34:26.977054Z"}],"euvd":[{"id":"EUVD-2022-40406","description":"In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.","status":"published","published":"2022-09-12T00:00:00Z","modified":"2024-08-03T10:37:41Z","updated_at":"2026-11-03T03:25:22.943717Z"}],"ghsa":[{"id":"GHSA-cm5p-p299-9f4g","title":"In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid...","description":"In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.","status":"published","published":"2022-09-13T00:00:39Z","modified":"2023-01-30T05:02:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:46:42.642348Z"}],"nvd":[{"id":"CVE-2022-37797","description":"In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.","status":"published","published":"2022-09-12T15:15:08.17Z","modified":"2026-06-17T04:55:15.5Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:07:27.631109Z"}],"osv":[{"id":"OESA-2022-1989","title":"lighttpd security update","description":"Secure, fast, compliant and very flexible web-server which has been optimized for high-performance environments. It has a very low memory footprint compared to other webservers and takes care of cpu-load. Its advanced feature-set (FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many more) make it the perfect webserver-software for every server that is suffering load problems.\r\n\r\nSecurity Fix(es):\r\n\r\nIn lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.(CVE-2022-37797)\n\nA resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/1.1 chunked situations. Use of mod_fastcgi is, for example, affected. This is fixed in 1.4.67.(CVE-2022-41556)","status":"published","published":"2022-10-14T11:05:18Z","modified":"2026-08-18T01:17:20.086793187Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2022-37797","description":"In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.","status":"published","published":"2022-09-12T15:15:00Z","modified":"2026-04-22T13:26:11.280984Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"CVE-2022-37797","description":"In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.","status":"published","published":"2022-09-12T00:00:00Z","modified":"2026-10-28T02:30:35.289668348Z","updated_at":"2026-11-02T15:44:26.53798Z"},{"id":"DEBIAN-CVE-2022-37797","description":"In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.","status":"published","published":"2022-09-12T15:15:08.17Z","modified":"2026-11-03T06:02:56.509961621Z","updated_at":"2026-11-03T06:43:19.563245Z"},{"id":"DLA-3133-1","title":"lighttpd - security update","status":"published","published":"2022-10-03T00:00:00Z","modified":"2026-03-09T01:23:31.544639Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5243-1","title":"lighttpd - security update","status":"published","published":"2022-09-28T00:00:00Z","modified":"2026-03-09T02:11:32.134328Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0369","title":"Updated lighttpd packages fix security vulnerability","description":"In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function\npointer if an invalid HTTP request (websocket handshake) is received. It\nleads to null pointer dereference which crashes the server. It could be\nused by an external attacker to cause denial of service condition.\n(CVE-2022-37797)\n\nA resource leak in mod_fastcgi and mod_scgi could lead to a denial of\nservice after a large number of bad HTTP requests. (CVE-2022-41556)\n","status":"published","published":"2022-10-13T20:05:19Z","modified":"2026-04-16T04:44:02.439165909Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2022:10132-1","title":"Security update for lighttpd","description":"This update for lighttpd fixes the following issues:\n\nlighttpd was updated to 1.4.66:\n\n* a number of bug fixes\n* Fix HTTP/2 downloads \u003e= 4GiB\n* Fix SIGUSR1 graceful restart with TLS\n* futher bug fixes\n* CVE-2022-37797: null pointer dereference in mod_wstunnel,\n  possibly a remotely triggerable crash (boo#1203358)\n* In an upcoming release the TLS modules will default to using\n  stronger, modern chiphers and will default to allow client\n  preference in selecting ciphers.\n  “CipherString” =\u003e “EECDH+AESGCM:AES256+EECDH:CHACHA20:SHA256:!SHA384”,\n  “Options” =\u003e “-ServerPreference”\n  old defaults:\n  “CipherString” =\u003e “HIGH”,\n  “Options” =\u003e “ServerPreference”\n* A number of TLS options are how deprecated and will be removed\n  in a future release:\n  – ssl.honor-cipher-order\n  – ssl.dh-file\n  – ssl.ec-curve\n  – ssl.disable-client-renegotiation\n  – ssl.use-sslv2\n  – ssl.use-sslv3\n  The replacement option is ssl.openssl.ssl-conf-cmd, but lighttpd\n  defaults should be prefered\n* A number of modules are now deprecated and will be removed in a\n  future release: mod_evasive, mod_secdownload, mod_uploadprogress,\n  mod_usertrack can be replaced by mod_magnet and a few lines of lua.\n\nupdate to 1.4.65:\n\n* WebSockets over HTTP/2\n* RFC 8441 Bootstrapping WebSockets with HTTP/2\n* HTTP/2 PRIORITY_UPDATE\n* RFC 9218 Extensible Prioritization Scheme for HTTP\n* prefix/suffix conditions in lighttpd.conf\n* mod_webdav safe partial-PUT\n* webdav.opts += (“partial-put-copy-modify” =\u003e “enable”)\n* mod_accesslog option: accesslog.escaping = “json”\n* mod_deflate libdeflate build option\n* speed up request body uploads via HTTP/2\n* Behavior Changes\n* change default server.max-keep-alive-requests = 1000 to adjust\n* to increasing HTTP/2 usage and to web2/web3 application usage\n* (prior default was 100)\n* mod_status HTML now includes HTTP/2 control stream id 0 in the output\n* which contains aggregate counts for the HTTP/2 connection\n* (These lines can be identified with URL ‘*’, part of “PRI *” preface)\n* alternative: https://wiki.lighttpd.net/ModMagnetExamples#lua-mod_status\n* MIME type application/javascript is translated to text/javascript (RFC 9239)\n","status":"published","published":"2022-09-29T09:54:26Z","modified":"2026-02-04T02:41:14.966239Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12327-1","title":"lighttpd-1.4.66-1.1 on GA media","description":"These are all security issues fixed in the lighttpd-1.4.66-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:43:57.076912Z","updated_at":"2026-11-02T16:58:35.485255Z"}]}}