Your submission was sent successfully! Close

CVE-2022-22707

Published: 6 January 2022

In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based buffer overflow (4 bytes representing -1), as demonstrated by remote denial of service (daemon crash) in a non-default configuration. The non-default configuration requires handling of the Forwarded header in a somewhat unusual manner. Also, a 32-bit system is much more likely to be affected than a 64-bit system.

Priority

Medium

CVSS 3 base score: 5.9

Status

Package Release Status
lighttpd
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Needs triage

upstream Needs triage

xenial Ignored
(out of standard support)