Lighttpd

mod_proxy_core_check_match() in mod_proxy_core, when
it has a session
&
sess->do_x_rewrite_backend
&
can't find a backend
&
can't create a one
, then the following codes will be run:

if (NULL == backend) {
buffer_free(sticky_session);
return HANDLER_GO_ON;
}

but sess is reset before, sess->p and sess->remote_con are all set to NULL. Here the function returns without set the sess->p and sess->remote_con.
These two pointers will be used later, so I think it will crash.