What’s Vulnerable › Vulnerabilities

CVE-2022-30780

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 57.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-06-11 · updated 2026-06-17
• Weakness: CWE-682

Description

Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c has a typo that disrupts use of multiple read operations on large headers.

Affected products

• lighttpd: 1.4.56, 1.4.57, 1.4.58

References

• https://github.com/lighttpd/lighttpd1.4
• https://github.com/p0dalirius/CVE-2022-30780-lighttpd-denial-of-service
• https://podalirius.net/en/cves/2022-30780/
• https://redmine.lighttpd.net/issues/3059
• https://github.com/lighttpd/lighttpd1.4
• https://github.com/p0dalirius/CVE-2022-30780-lighttpd-denial-of-service
• https://podalirius.net/en/cves/2022-30780/
• https://redmine.lighttpd.net/issues/3059

Get alerted when CVE-2022-30780 or the next vulnerability affects your stack