Description
In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lighttpd | 1.4.66-1 | — |
| Debian 13 | lighttpd | 1.4.66-1 | — |
| Debian 12 | lighttpd | 1.4.66-1 | — |
| Debian 11 | lighttpd | 1.4.59-1+deb11u2 | DSA-5243-1 |
| Debian 10 | lighttpd | 1.4.53-4+deb10u3 | DLA-3133-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | lighttpd | No fix yet | — |
| Ubuntu 20.04 LTS | lighttpd | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP4 | lighttpd | 1.4.66-bp154.2.3.1 | openSUSE-SU-2022:10132-1 |
| SUSE Package Hub 15 SP3 | lighttpd | 1.4.66-bp154.2.3.1 | openSUSE-SU-2022:10132-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | lighttpd | 1.4.66-1.1 | openSUSE-SU-2024:12327-1 |
| openSUSE Leap 15.4 | lighttpd | 1.4.66-bp154.2.3.1 | openSUSE-SU-2022:10132-1 |
| openSUSE Leap 15.3 | lighttpd | 1.4.66-bp154.2.3.1 | openSUSE-SU-2022:10132-1 |
Advisories 8
- DSA-5243-1 lighttpd - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3133-1 lighttpd - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:12327-1 lighttpd-1.4.66-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2022:10132-1 Security update for lighttpd SUSE / openSUSE Security Updates · Feb 4, 2026
- SSA-806742 SSA-806742: Multiple Vulnerabilities in SCALANCE XCM-/XRM-300 before V2.4 Siemens ProductCERT · Feb 13, 2024
- ICSA-24-046-11 Siemens SCALANCE XCM-/XRM-300 CISA ICS & IT advisories · Feb 13, 2024
- WID-SEC-2023-0561 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2023
- WID-SEC-2022-1395 lighttpd: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Mar 22, 2023
References
- https://redmine.lighttpd.net/issues/3165
- DSA-5243 vendor-advisory
- [debian-lts-announce] 20221003 [SECURITY] [DLA 3133-1] lighttpd security update mailing-list
- GLSA-202210-12 vendor-advisory