### Background

Lighttpd is a lightweight high-performance web server.

### Description

Lighttpd’s mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received.

### Impact

An attacker can trigger a denial of service via making Lighttpd try to call an uninitialized function pointer.

### Workaround

There is no known workaround at this time.

### Resolution

All lighttpd users should upgrade to the latest version:

# emerge –sync
# emerge –ask –oneshot –verbose “>=www-servers/lighttpd-1.4.67”Read More