Read the docs
TI-2022-15015 Aliases CVE-2022-34037

An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in…

Priority LOW 35CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an administrator's bad configuration containing a malformed request URI caused the server to return an empty reply instead of a valid HTTP response to the client.

Why it matters now

EPSS 0.01177 67th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:caddyserver:caddy:2.5.1:*:*:*:*:*:*:*2.5.1Vulnerablecaddyserver
  • cpe:2.3:a:caddyserver:caddy:2.5.1:*:*:*:*:*:*:* Versions 2.5.1 Vulnerable ·caddyserver

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 8 products
  • Migration Toolkit for Containers
  • OpenShift API for Data Protection
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift GitOps
  • Red Hat Openshift Container Storage 4
  • Red Hat Openshift Data Foundation 4
  • Red Hat Openshift Sandboxed Containers

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-34037

References

Exploit 1

Other 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-21978 Improper input validation in caddyserver caddy CVSS 4.0HIGH 8.9
  • TI-2026-21974 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed CVSS 4.0HIGH 8.8
  • TI-2026-23680 Improper authentication in caddyserver caddy CVSS 3.1HIGH 8.8
  • TI-2026-21976 Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass CVSS 4.0HIGH 7.7
  • TI-2026-21975 Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass CVSS 4.0HIGH 7.7
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences