CVE-2022-34037 Details
Description
An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an administrator's bad configuration containing a malformed request URI caused the server to return an empty reply instead of a valid HTTP response to the client.
A vulnerability in Caddy version 2.5.1's HTTP rewrite module allows for an out-of-bounds read, which can lead to a denial-of-service condition. This issue arises from a flawed URI parsing implementation in the rewrite function, where certain URI fragments can cause a runtime panic by creating invalid slice bounds. Although this vulnerability was reported as a security issue, it has been disputed, with claims that it merely reflects a bug in handling malformed URIs, particularly under 'bad' configuration scenarios. The reported issue does not affect server availability, as Caddy continues to process requests normally after logging the error.
Users can upgrade to Caddy version 2.5.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/caddyserver/caddy/issues/4775 | CVE | ExploitIssue TrackingPatchThird Party Advisory |
| https://github.com/caddyserver/caddy/issues/4775#issuecomment-1203388116 | CVE | |
| https://github.com/caddyserver/caddy/issues/4775 | [email protected] | ExploitIssue TrackingPatchThird Party Advisory |
| https://github.com/caddyserver/caddy/issues/4775#issuecomment-1203388116 | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| caddyserver caddy | 2.5.1 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| Aug 3, 2024 | CVE Modified | [email protected] |
| May 17, 2024 | CVE Modified | [email protected] |
| May 14, 2024 | CVE Modified | [email protected] |
| May 3, 2024 | CVE Modified | [email protected] |
| Jul 28, 2022 | Initial Analysis | [email protected] |