CVE-2022-30780
📋 TL;DR
A typo in Lighttpd's connection handling code causes the server to get stuck processing large HTTP headers, consuming CPU resources indefinitely. This allows remote attackers to cause denial of service by sending specially crafted requests. All Lighttpd servers running vulnerable versions are affected.
💻 Affected Systems
- Lighttpd
📦 What is this software?
Lighttpd by Lighttpd
Lighttpd by Lighttpd
Lighttpd by Lighttpd
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion, potentially affecting all hosted websites and applications.
Likely Case
Degraded performance and intermittent service disruptions as connections get stuck.
If Mitigated
Minimal impact with proper monitoring and rate limiting in place.
🎯 Exploit Status
Simple HTTP requests with large headers can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.59
Vendor Advisory: https://redmine.lighttpd.net/issues/3059
Restart Required: Yes
Instructions:
1. Download Lighttpd 1.4.59 or later from official sources. 2. Stop the Lighttpd service. 3. Install the new version. 4. Restart the Lighttpd service.
🔧 Temporary Workarounds
Rate Limit HTTP Headers
allConfigure reverse proxy or WAF to limit header size and rate limit requests.
# Example nginx config: client_header_buffer_size 1k; large_client_header_buffers 4 8k;
🧯 If You Can't Patch
- Deploy a reverse proxy or WAF in front of Lighttpd to filter malicious requests.
- Implement network-level rate limiting and monitor for abnormal connection patterns.
🔍 How to Verify
Check if Vulnerable:
Check Lighttpd version with: lighttpd -vCheck Version:
lighttpd -vVerify Fix Applied:
Confirm version is 1.4.59 or higher with: lighttpd -v📡 Detection & Monitoring
Log Indicators:
- Multiple connections stuck in reading state
- High CPU usage without corresponding request completion
Network Indicators:
- HTTP requests with abnormally large headers
- Multiple connections from single source with incomplete requests
SIEM Query:
source="lighttpd.log" AND ("stuck" OR "read_header" OR "connection_read_header_more")🔗 References
- https://github.com/lighttpd/lighttpd1.4
- https://github.com/p0dalirius/CVE-2022-30780-lighttpd-denial-of-service
- https://podalirius.net/en/cves/2022-30780/
- https://redmine.lighttpd.net/issues/3059
- https://github.com/lighttpd/lighttpd1.4
- https://github.com/p0dalirius/CVE-2022-30780-lighttpd-denial-of-service
- https://podalirius.net/en/cves/2022-30780/
- https://redmine.lighttpd.net/issues/3059
