CVE catalog

CVE-2022-22707

lighttpd: CVE-2022-22707

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
8.93% · Oct 25, 2026

In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based buffer overflow (4 bytes representing -1), as demonstrated by remote denial of service (daemon crash) in a non-default configuration. The non-default configuration requires handling of the Forwarded header in a somewhat unusual manner. Also, a 32-bit system is much more likely to be affected than a 64-bit system.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlighttpdsid1.4.85-1fixed
Debianlighttpdforky1.4.85-1fixed
Debianlighttpdtrixie1.4.79-2fixed
Debianlighttpdbookworm1.4.69-1fixed
Ubuntulighttpd20.041.4.53-4ubuntu2vulnerable
Ubuntulighttpd20.041.4.54-2ubuntu1vulnerable
Ubuntulighttpd20.041.4.55-1ubuntu1vulnerable
Ubuntulighttpd20.041.4.55-1ubuntu1.20.04.1vulnerable
Ubuntulighttpd20.041.4.55-1ubuntu1.20.04.2fixed
Ubuntulighttpd22.041.4.59-1ubuntu2vulnerable
Ubuntulighttpd22.041.4.59-1ubuntu3vulnerable
Ubuntulighttpd22.041.4.63-1ubuntu1vulnerable
Ubuntulighttpd22.041.4.63-1ubuntu2vulnerable
Ubuntulighttpd22.041.4.63-1ubuntu3vulnerable
Ubuntulighttpd22.041.4.63-1ubuntu3.1fixed
Ubuntulighttpd20.041.4.53-4ubuntu2vulnerable
Ubuntulighttpd20.041.4.54-2ubuntu1vulnerable
Ubuntulighttpd20.041.4.55-1ubuntu1vulnerable
Ubuntulighttpd20.041.4.55-1ubuntu1.20.04.1vulnerable
Ubuntulighttpd20.041.4.55-1ubuntu1.20.04.2fixed
Ubuntulighttpd22.041.4.59-1ubuntu2vulnerable
Ubuntulighttpd22.041.4.59-1ubuntu3vulnerable
Ubuntulighttpd22.041.4.63-1ubuntu1vulnerable
Ubuntulighttpd22.041.4.63-1ubuntu2vulnerable
Ubuntulighttpd22.041.4.63-1ubuntu3vulnerable
Ubuntulighttpd22.041.4.63-1ubuntu3.1fixed
Opensuselighttpdtumbleweed1.4.64-1.1fixed
Suselighttpdpackage hub 15 sp31.4.64-bp153.2.3.1fixed
Opensuselighttpdleap 15.31.4.64-bp153.2.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlighttpdsourcesid1.4.64-1not yet assignedNot reportedNot reported
Debianlighttpdsourceforky1.4.64-1not yet assignedNot reportedNot reported
Debianlighttpdsourcetrixie1.4.64-1not yet assignedNot reportedNot reported
Debianlighttpdsourcebookworm1.4.64-1not yet assignedNot reportedNot reported
Ubuntulighttpddeb20.041.4.55-1ubuntu1.20.04.2Not reportedUSN-5903-1Not reported
Ubuntulighttpddeb22.041.4.63-1ubuntu3.1Not reportedUSN-5903-1Not reported
Ubuntulighttpddeb20.041.4.55-1ubuntu1.20.04.2Not reportedUBUNTU-CVE-2022-22707Not reported
Ubuntulighttpddeb22.041.4.63-1ubuntu3.1Not reportedUBUNTU-CVE-2022-22707Not reported
Opensuselighttpdrpmtumbleweed1.4.64-1.1Not reportedOPENSUSE-SU-2024:11764-1Not reported
Suselighttpdrpmpackage hub 15 sp31.4.64-bp153.2.3.1Not reportedOPENSUSE-SU-2022:0024-1Not reported
Opensuselighttpdrpmleap 15.31.4.64-bp153.2.3.1Not reportedOPENSUSE-SU-2022:0024-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [lighttpd-mod_authn_dbi]Unknown

    Source package: [lighttpd]

    Details (1)

    • 1.4.85-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.64-1.1

      Version impact unknown

      dsa · lighttpd · opensuse · tumbleweed

  • [lighttpd-mod_authn_gssapi]Unknown

    Source package: [lighttpd]

    Details (1)

    • 1.4.85-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.64-1.1

      Version impact unknown

      dsa · lighttpd · opensuse · tumbleweed

  • [lighttpd-mod_authn_ldap]Unknown

    Source package: [lighttpd]

    Details (1)

    • 1.4.85-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.64-1.1

      Version impact unknown

      dsa · lighttpd · opensuse · tumbleweed

  • [lighttpd-mod_authn_pam]Unknown

    Source package: [lighttpd]

    Details (1)

    • 1.4.85-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.64-1.1

      Version impact unknown

      dsa · lighttpd · opensuse · tumbleweed

  • [lighttpd-mod_authn_sasl]Unknown

    Source package: [lighttpd]

    Details (1)

    • 1.4.85-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.64-1.1

      Version impact unknown

      dsa · lighttpd · opensuse · tumbleweed

  • [lighttpd-mod_deflate]Unknown

    Source package: [lighttpd]

    Details (1)

    • 1.4.85-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.64-1.1

      Version impact unknown

      dsa · lighttpd · opensuse · tumbleweed

  • [lighttpd-mod_gnutls]Unknown

    Source package: [lighttpd]

    Details (1)

    • 1.4.85-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.64-1.1

      Version impact unknown

      dsa · lighttpd · opensuse · tumbleweed

  • [lighttpd-mod_magnet]Unknown

    Source package: [lighttpd]

    Details (1)

    • 1.4.85-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.64-1.1

      Version impact unknown

      dsa · lighttpd · opensuse · tumbleweed

  • [lighttpd-mod_maxminddb]Unknown

    Source package: [lighttpd]

    Details (1)

    • 1.4.85-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.64-1.1

      Version impact unknown

      dsa · lighttpd · opensuse · tumbleweed

  • [lighttpd-mod_mbedtls]Unknown

    Source package: [lighttpd]

    Details (1)

    • 1.4.85-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.64-1.1

      Version impact unknown

      dsa · lighttpd · opensuse · tumbleweed

  • [lighttpd-mod_nss]Unknown

    Source package: [lighttpd]

    Details (1)

    • 1.4.85-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.64-1.1

      Version impact unknown

      dsa · lighttpd · opensuse · tumbleweed

  • [lighttpd-mod_openssl]Unknown

    Source package: [lighttpd]

    Details (1)

    • 1.4.85-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.64-1.1

      Version impact unknown

      dsa · lighttpd · opensuse · tumbleweed

  • [lighttpd-mod_rrdtool]Unknown

    Source package: [lighttpd]

    Details (1)

    • 1.4.85-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.64-1.1

      Version impact unknown

      dsa · lighttpd · opensuse · tumbleweed

  • [lighttpd-mod_vhostdb_dbi]Unknown

    Source package: [lighttpd]

    Details (1)

    • 1.4.85-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.64-1.1

      Version impact unknown

      dsa · lighttpd · opensuse · tumbleweed

  • [lighttpd-mod_vhostdb_ldap]Unknown

    Source package: [lighttpd]

    Details (1)

    • 1.4.85-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.64-1.1

      Version impact unknown

      dsa · lighttpd · opensuse · tumbleweed

  • [lighttpd-mod_vhostdb_mysql]Unknown

    Source package: [lighttpd]

    Details (1)

    • 1.4.85-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.64-1.1

      Version impact unknown

      dsa · lighttpd · opensuse · tumbleweed

  • [lighttpd-mod_vhostdb_pgsql]Unknown

    Source package: [lighttpd]

    Details (1)

    • 1.4.85-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.64-1.1

      Version impact unknown

      dsa · lighttpd · opensuse · tumbleweed

  • [lighttpd-mod_webdav]Unknown

    Source package: [lighttpd]

    Details (1)

    • 1.4.85-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.64-1.1

      Version impact unknown

      dsa · lighttpd · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [lighttpd]Fixed
    Details (2)

    • 1.4.69-1 · amd64 · bookworm

      Fixed · Fixed: 1.4.64-1

      dsa · lighttpd · debian · bookworm

    • 1.4.69-1 · arm64 · bookworm

      Fixed · Fixed: 1.4.64-1

      dsa · lighttpd · debian · bookworm

  • [lighttpd-doc]Fixed

    Source package: [lighttpd]

    Details (2)

    • 1.4.69-1 · all · bookworm

      Fixed · Fixed: 1.4.64-1

      dsa · lighttpd · debian · bookworm

    • 1.4.69-1 · all · bookworm

      Fixed · Fixed: 1.4.64-1

      dsa · lighttpd · debian · bookworm

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]