Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Caddy v2.5.1: Invalid Config Can Cause Server Crash

CVE-2022-34037 · published 4 years ago
Summary

A misconfigured Caddy server can crash if it receives a specially crafted request. This is not a security vulnerability, but rather a result of a poorly set up configuration. To avoid this, review and correct any custom configurations to ensure they're correct and safe.

What to do
  • Update github.com caddyserver to version 2.5.2.
Affected software
Ecosystem VendorProductAffected versions
go github.com caddyserver < 2.5.2
Fix: upgrade to 2.5.2
– caddyserver caddy 2.5.1
cpe:2.3:a:caddyserver:caddy:2.5.1:*:*:*:*:*:*:*
Original advisory text
An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI. Note: This has been dis...
An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an administrator's bad configuration containing a malformed request URI caused the server to return an empty reply instead of a valid HTTP response to the client.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
Timeline
Published22 Jul 2022
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-m7gr-5w5g-36jf · GHSA
CVE-2022-34037 · NVD
CVE-2022-34037 · OSV
Track software like this
Free during beta