CVE-2022-30780

Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c has a typo that disrupts use of multiple read operations on large headers.

• CWE-682

• https://github.com/lighttpd/lighttpd1.4Product, Third Party Advisory
• https://github.com/p0dalirius/CVE-2022-30780-lighttpd-denial-of-serviceExploit, Third Party Advisory
• https://podalirius.net/en/cves/2022-30780/Exploit, Third Party Advisory
• https://redmine.lighttpd.net/issues/3059Issue Tracking, Patch, Vendor Advisory
• https://github.com/lighttpd/lighttpd1.4Product, Third Party Advisory
• https://github.com/p0dalirius/CVE-2022-30780-lighttpd-denial-of-serviceExploit, Third Party Advisory
• https://podalirius.net/en/cves/2022-30780/Exploit, Third Party Advisory
• https://redmine.lighttpd.net/issues/3059Issue Tracking, Patch, Vendor Advisory

Published

Jun 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30775xpdf 4.04 allocates excessive memory when presented with cra…5.5
• CVE-2022-30776atmail 6.5.0 allows XSS via the index.php/admin/index/ error…6.1
• CVE-2022-30777Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php …6.1
• CVE-2022-30778Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-30779Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-3078An issue was discovered in the Linux kernel through 5.16-rc6…5.5
• CVE-2022-30781Gitea before 1.16.7 does not escape git fetch remote.7.5
• CVE-2022-30782Openmoney API through 2020-06-29 uses the JavaScript Math.ra…7.5
• CVE-2022-30783An invalid return code in fuse_kern_mount enables intercepti…6.7
• CVE-2022-30784A crafted NTFS image can cause heap exhaustion in ntfs_get_a…7.8
• CVE-2022-30785A file handle created in fuse_lib_opendir, and later used in…6.7
• CVE-2022-30786A crafted NTFS image can cause a heap-based buffer overflow …7.8