CVE-2022-22707

In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based buffer overflow (4 bytes representing -1), as demonstrated by remote denial of service (daemon crash) in a non-default configuration. The non-default configuration requires handling of the Forwarded header in a somewhat unusual manner. Also, a 32-bit system is much more likely to be affected than a 64-bit system.

• CWE-787

• https://redmine.lighttpd.net/issues/3134Exploit, Vendor Advisory
• https://www.debian.org/security/2022/dsa-5040Third Party Advisory
• https://redmine.lighttpd.net/issues/3134Exploit, Vendor Advisory
• https://www.debian.org/security/2022/dsa-5040Third Party Advisory

Published

Jan 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-22700CyberArk Identity versions up to and including 22.1 in the '…5.3
• CVE-2022-22701PartKeepr versions up to v1.4.0, loads attachments using a U…6.5
• CVE-2022-22702PartKeepr versions up to v1.4.0, in the functionality to upl…4.3
• CVE-2022-22703In Stormshield SSO Agent 2.x before 2.1.1 and 3.x before 3.0…5.5
• CVE-2022-22704The zabbix-agent2 package before 5.4.9-r1 for Alpine Linux s…9.8
• CVE-2022-22706Arm Mali GPU Kernel Driver allows a non-privileged user to a…7.8
• CVE-2022-22709VP9 Video Extensions Remote Code Execution Vulnerability7.8
• CVE-2022-2271The WP Database Backup WordPress plugin before 5.9 does not …4.8
• CVE-2022-22710Windows Common Log File System Driver Denial of Service Vuln…5.5
• CVE-2022-22711Windows BitLocker Information Disclosure Vulnerability5.7
• CVE-2022-22712Windows Hyper-V Denial of Service Vulnerability5.6
• CVE-2022-22713Windows Hyper-V Denial of Service Vulnerability5.6