{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_informational_advisory","csaf_version":"2.1","title":"lighttpd denial of service vulnerability (CVE-2022-41556)","distribution":{"tlp":{"label":"CLEAR"}},"publisher":{"category":"vendor","name":"WatchGuard PSIRT","namespace":"https://www.watchguard.com"},"tracking":{"id":"WGSA-2024-00005","status":"final","version":"25","initial_release_date":"2024-02-16T02:32:05+00:00","current_release_date":"2026-07-28T01:21:34.646462+00:00","revision_history":[{"date":"2024-02-16T02:32:05+00:00","number":"25","summary":"Initial release."}]},"references":[{"summary":"vendor-advisory","url":"https://psirt.watchguard.com/WGSA-2024-00005"},{"summary":"cve","url":"https://www.cve.org/CVERecord?id=CVE-2022-41556"}],"notes":[{"category":"summary","text":"A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/1.1 chunked situations. Use of mod_fastcgi is, for example, affected. This is fixed in 1.4.67.\n\nNo WatchGuard products are affected by this vulnerability","title":"Summary"}]}}