# CVE-2022-22707: lighttpd: In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-bas...

CVE-2022-22707 is fixed in 21 products on 1 platform, first by lighttpd 1.4.55-1ubuntu1.20.04.2, released January 5, 2022. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2022-22707
- Priority: Routine
- CVSS: 5.9 (Low)
- EPSS: 0.0966
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jan 5, 2022

## Description

In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based buffer overflow (4 bytes representing -1), as demonstrated by remote denial of service (daemon crash) in a non-default configuration. The non-default configuration requires handling of the Forwarded header in a somewhat unusual manner. Also, a 32-bit system is much more likely to be affected than a 64-bit system.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | lighttpd Debian 11.6 (bullseye) | 1.4.59-1+deb11u1 | [DSA-5040-1](https://patchblox.com/security/data/fix/linux/dsa-5040-1.md) | Jan 11, 2022 |
| Linux | lighttpd Debian 12.15 (bookworm) | 1.4.64-1 | [DEBIAN-CVE-2022-22707](https://patchblox.com/security/data/fix/linux/debian-cve-2022-22707.md) | Jan 6, 2022 |
| Linux | lighttpd Debian 13.5 (trixie) | 1.4.64-1 | [DEBIAN-CVE-2022-22707](https://patchblox.com/security/data/fix/linux/debian-cve-2022-22707.md) | Jan 6, 2022 |
| Linux | lighttpd Debian 14 | 1.4.64-1 | [DEBIAN-CVE-2022-22707](https://patchblox.com/security/data/fix/linux/debian-cve-2022-22707.md) | Jan 6, 2022 |
| Linux | lighttpd Ubuntu 20.04 LTS (focal) | 1.4.55-1ubuntu1.20.04.2 | [lighttpd 1.4.55-1ubuntu1.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-lighttpd-1.4.55-1ubuntu1.20.04.2.md) | Jan 5, 2022 |
| Linux | lighttpd Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-authn-gssapi Ubuntu 20.04 LTS (focal) | 1.4.55-1ubuntu1.20.04.2 | [lighttpd-mod-authn-gssapi 1.4.55-1ubuntu1.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-lighttpd-mod-authn-gssapi-1.4.55-1ubuntu1.20.04.2.md) | Jan 5, 2022 |
| Linux | lighttpd-mod-authn-gssapi Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-authn-gssapi 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-authn-gssapi-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-authn-pam Ubuntu 20.04 LTS (focal) | 1.4.55-1ubuntu1.20.04.2 | [lighttpd-mod-authn-pam 1.4.55-1ubuntu1.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-lighttpd-mod-authn-pam-1.4.55-1ubuntu1.20.04.2.md) | Jan 5, 2022 |
| Linux | lighttpd-mod-authn-pam Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-authn-pam 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-authn-pam-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-authn-sasl Ubuntu 20.04 LTS (focal) | 1.4.55-1ubuntu1.20.04.2 | [lighttpd-mod-authn-sasl 1.4.55-1ubuntu1.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-lighttpd-mod-authn-sasl-1.4.55-1ubuntu1.20.04.2.md) | Jan 5, 2022 |
| Linux | lighttpd-mod-authn-sasl Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-authn-sasl 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-authn-sasl-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-cml Ubuntu 20.04 LTS (focal) | 1.4.55-1ubuntu1.20.04.2 | [lighttpd-mod-cml 1.4.55-1ubuntu1.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-lighttpd-mod-cml-1.4.55-1ubuntu1.20.04.2.md) | Jan 5, 2022 |
| Linux | lighttpd-mod-deflate Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-deflate 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-deflate-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-geoip Ubuntu 20.04 LTS (focal) | 1.4.55-1ubuntu1.20.04.2 | [lighttpd-mod-geoip 1.4.55-1ubuntu1.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-lighttpd-mod-geoip-1.4.55-1ubuntu1.20.04.2.md) | Jan 5, 2022 |
| Linux | lighttpd-mod-geoip Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-geoip 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-geoip-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-magnet Ubuntu 20.04 LTS (focal) | 1.4.55-1ubuntu1.20.04.2 | [lighttpd-mod-magnet 1.4.55-1ubuntu1.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-lighttpd-mod-magnet-1.4.55-1ubuntu1.20.04.2.md) | Jan 5, 2022 |
| Linux | lighttpd-mod-maxminddb Ubuntu 20.04 LTS (focal) | 1.4.55-1ubuntu1.20.04.2 | [lighttpd-mod-maxminddb 1.4.55-1ubuntu1.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-lighttpd-mod-maxminddb-1.4.55-1ubuntu1.20.04.2.md) | Jan 5, 2022 |
| Linux | lighttpd-mod-maxminddb Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-maxminddb 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-maxminddb-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-mbedtls Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-mbedtls 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-mbedtls-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-nss Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-nss 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-nss-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-openssl Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-openssl 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-openssl-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-trigger-b4-dl Ubuntu 20.04 LTS (focal) | 1.4.55-1ubuntu1.20.04.2 | [lighttpd-mod-trigger-b4-dl 1.4.55-1ubuntu1.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-lighttpd-mod-trigger-b4-dl-1.4.55-1ubuntu1.20.04.2.md) | Jan 5, 2022 |
| Linux | lighttpd-mod-trigger-b4-dl Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-trigger-b4-dl 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-trigger-b4-dl-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-vhostdb-dbi Ubuntu 20.04 LTS (focal) | 1.4.55-1ubuntu1.20.04.2 | [lighttpd-mod-vhostdb-dbi 1.4.55-1ubuntu1.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-lighttpd-mod-vhostdb-dbi-1.4.55-1ubuntu1.20.04.2.md) | Jan 5, 2022 |
| Linux | lighttpd-mod-vhostdb-pgsql Ubuntu 20.04 LTS (focal) | 1.4.55-1ubuntu1.20.04.2 | [lighttpd-mod-vhostdb-pgsql 1.4.55-1ubuntu1.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-lighttpd-mod-vhostdb-pgsql-1.4.55-1ubuntu1.20.04.2.md) | Jan 5, 2022 |
| Linux | lighttpd-mod-vhostdb-pgsql Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-vhostdb-pgsql 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-vhostdb-pgsql-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-webdav Ubuntu 20.04 LTS (focal) | 1.4.55-1ubuntu1.20.04.2 | [lighttpd-mod-webdav 1.4.55-1ubuntu1.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-lighttpd-mod-webdav-1.4.55-1ubuntu1.20.04.2.md) | Jan 5, 2022 |
| Linux | lighttpd-mod-webdav Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-webdav 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-webdav-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-wolfssl Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-wolfssl 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-wolfssl-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-modules-dbi Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-modules-dbi 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-modules-dbi-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-modules-ldap Ubuntu 20.04 LTS (focal) | 1.4.55-1ubuntu1.20.04.2 | [lighttpd-modules-ldap 1.4.55-1ubuntu1.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-lighttpd-modules-ldap-1.4.55-1ubuntu1.20.04.2.md) | Jan 5, 2022 |
| Linux | lighttpd-modules-ldap Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-modules-ldap 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-modules-ldap-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-modules-lua Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-modules-lua 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-modules-lua-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-modules-mysql Ubuntu 20.04 LTS (focal) | 1.4.55-1ubuntu1.20.04.2 | [lighttpd-modules-mysql 1.4.55-1ubuntu1.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-lighttpd-modules-mysql-1.4.55-1ubuntu1.20.04.2.md) | Jan 5, 2022 |
| Linux | lighttpd-modules-mysql Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-modules-mysql 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-modules-mysql-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.