### Background
Lighttpd is a lightweight high-performance web server.
### Description
Lighttpd’s mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received.
### Impact
An attacker can trigger a denial of service via making Lighttpd try to call an uninitialized function pointer.
### Workaround
There is no known workaround at this time.
### Resolution
All lighttpd users should upgrade to the latest version:
# emerge –sync
# emerge –ask –oneshot –verbose “>=www-servers/lighttpd-1.4.67”Read More