# CVE-2022-41556: lighttpd: A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot...

CVE-2022-41556 is fixed in 18 products on 1 platform, first by lighttpd 1.4.63-1ubuntu3.1, released October 6, 2022. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2022-41556
- Priority: High
- CVSS: 7.5 (Medium)
- EPSS: 0.0383
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 6, 2022

## Description

A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/1.1 chunked situations. Use of mod_fastcgi is, for example, affected. This is fixed in 1.4.67.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | lighttpd Debian 12.15 (bookworm) | 1.4.67-1 | [DEBIAN-CVE-2022-41556](https://patchblox.com/security/data/fix/linux/debian-cve-2022-41556.md) | Oct 6, 2022 |
| Linux | lighttpd Debian 13.5 (trixie) | 1.4.67-1 | [DEBIAN-CVE-2022-41556](https://patchblox.com/security/data/fix/linux/debian-cve-2022-41556.md) | Oct 6, 2022 |
| Linux | lighttpd Debian 14 | 1.4.67-1 | [DEBIAN-CVE-2022-41556](https://patchblox.com/security/data/fix/linux/debian-cve-2022-41556.md) | Oct 6, 2022 |
| Linux | lighttpd Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-authn-gssapi Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-authn-gssapi 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-authn-gssapi-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-authn-pam Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-authn-pam 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-authn-pam-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-authn-sasl Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-authn-sasl 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-authn-sasl-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-deflate Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-deflate 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-deflate-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-geoip Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-geoip 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-geoip-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-maxminddb Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-maxminddb 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-maxminddb-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-mbedtls Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-mbedtls 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-mbedtls-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-nss Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-nss 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-nss-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-openssl Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-openssl 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-openssl-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-trigger-b4-dl Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-trigger-b4-dl 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-trigger-b4-dl-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-vhostdb-pgsql Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-vhostdb-pgsql 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-vhostdb-pgsql-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-webdav Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-webdav 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-webdav-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-mod-wolfssl Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-mod-wolfssl 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-mod-wolfssl-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-modules-dbi Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-modules-dbi 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-modules-dbi-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-modules-ldap Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-modules-ldap 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-modules-ldap-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-modules-lua Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-modules-lua 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-modules-lua-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |
| Linux | lighttpd-modules-mysql Ubuntu 22.04.1 LTS (jammy) | 1.4.63-1ubuntu3.1 | [lighttpd-modules-mysql 1.4.63-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-lighttpd-modules-mysql-1.4.63-1ubuntu3.1.md) | Oct 6, 2022 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.