In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | amazon-linux-upgrade-lighttpd | Mar 23, 2023 | Sep 12, 2022 |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Sep 12, 2022 | |
| Debian | debian-upgrade-lighttpd | Oct 4, 2022 | Sep 12, 2022 | |
| Gentoo Linux | gentoo-linux-upgrade-www-servers-lighttpd | Oct 31, 2022 | Sep 12, 2022 | |
| Http Lighttpd | http-lighttpd-upgrade-latest | Sep 19, 2024 | Sep 12, 2022 | |
| Suse | — | suse-upgrade-lighttpdsuse-upgrade-lighttpd-mod_authn_gssapisuse-upgrade-lighttpd-mod_authn_ldapsuse-upgrade-lighttpd-mod_authn_pamsuse-upgrade-lighttpd-mod_authn_saslsuse-upgrade-lighttpd-mod_magnetsuse-upgrade-lighttpd-mod_maxminddbsuse-upgrade-lighttpd-mod_rrdtoolsuse-upgrade-lighttpd-mod_vhostdb_dbisuse-upgrade-lighttpd-mod_vhostdb_ldapsuse-upgrade-lighttpd-mod_vhostdb_mysqlsuse-upgrade-lighttpd-mod_vhostdb_pgsqlsuse-upgrade-lighttpd-mod_webdav | Oct 26, 2022 | Sep 12, 2022 |
| Ubuntu | no-fix-ubuntu-package | Jun 26, 2025 | Sep 12, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub