CVE-2022-41556: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 3.8% chance of exploitation in the next 30 days.

A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/1.1 chunked situations. Use of mod_fastcgi is, for example, affected. This is fixed in 1.4.67.

Affected products

• Fedoraproject Fedora: version 35 only
• Lighttpd Lighttpd: from 1.4.56, before 1.4.67 (fixed in 1.4.67)

Published 2022-10-06. Last modified 2026-06-17.