CVE-2022-41556

A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/1.1 chunked situations. Use of mod_fastcgi is, for example, affected. This is fixed in 1.4.67.

• CWE-401

• https://git.lighttpd.net/lighttpd/lighttpd1.4/commit/b18de6f9264f914f7bf493abd3b6059343548e50Patch, Third Party Advisory
• https://github.com/lighttpd/lighttpd1.4/compare/lighttpd-1.4.66...lighttpd-1.4.67Third Party Advisory
• https://github.com/lighttpd/lighttpd1.4/pull/115Exploit, Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVOSBSCMLGCHH2Z74H64ZWVDFJFQTBC2/
• https://security.gentoo.org/glsa/202210-12Third Party Advisory
• https://git.lighttpd.net/lighttpd/lighttpd1.4/commit/b18de6f9264f914f7bf493abd3b6059343548e50Patch, Third Party Advisory
• https://github.com/lighttpd/lighttpd1.4/compare/lighttpd-1.4.66...lighttpd-1.4.67Third Party Advisory
• https://github.com/lighttpd/lighttpd1.4/pull/115Exploit, Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVOSBSCMLGCHH2Z74H64ZWVDFJFQTBC2/
• https://security.gentoo.org/glsa/202210-12Third Party Advisory

Published

Oct 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-41550GNU oSIP v5.3.0 was discovered to contain an integer overflo…6.5
• CVE-2022-41551Garage Management System v1.0 was discovered to contain a SQ…7.2
• CVE-2022-41552Server-Side Request Forgery (SSRF) vulnerability in Hitachi …9.8
• CVE-2022-41553Insertion of Sensitive Information into Temporary File vulne…5.5
• CVE-2022-41554Stored Cross-Site Scripting (XSS) vulnerability in John West…5.4
• CVE-2022-41555The affected product DIAEnergie (versions prior to v1.9.01.0…5.4
• CVE-2022-41558The Visualizations component of TIBCO Software Inc.'s TIBCO …5.4
• CVE-2022-41559The Web Client component of TIBCO Software Inc.'s TIBCO Nimb…9.3
• CVE-2022-4156The Contest Gallery WordPress plugin before 19.1.5.1, Contes…7.5
• CVE-2022-41560The Statement Set Upload via the Web Client component of TIB…6.5
• CVE-2022-41561The JNDI Data Sources component of TIBCO Software Inc.'s TIB…7.2
• CVE-2022-41562The HTML escaping component of TIBCO Software Inc.'s TIBCO J…8.4