CVE-2022-30780: Lighttpd

High severity, CVSS 7.5. EPSS: 56.9% chance of exploitation in the next 30 days.

Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c has a typo that disrupts use of multiple read operations on large headers.

Affected products

• Lighttpd Lighttpd: version 1.4.56 only; version 1.4.57 only; version 1.4.58 only

Published 2022-06-11. Last modified 2026-06-17.