CVE-2022-37797

HIGH
Published Sep 12, 20223y ago · Modified Jun 17, 20261w ago
7.5 CVSS 3.1
High
Find Similar
Published Sep 12, 2022 3y ago
Last Modified Jun 17, 2026 1w ago

Description

In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-476 NULL Pointer Dereference Memory Safety

Affected Products 2

VendorProductVersionRange
lighttpdlighttpd1.4.65any
debiandebian_linux10.0any

References 4

  • lists.debian.org https://lists.debian.org/debian-lts-announce/2022/10/msg00002.html
    Mailing ListThird Party Advisory
  • redmine.lighttpd.net https://redmine.lighttpd.net/issues/3165
    ExploitIssue TrackingThird Party Advisory
  • security.gentoo.org https://security.gentoo.org/glsa/202210-12
    Third Party Advisory
  • debian.org https://www.debian.org/security/2022/dsa-5243
    Mailing ListThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.