CVE-2022-34037 Denial of service in n/a

What is CVE-2022-34037?

CVE-2022-34037 is a high-severity denial of service vulnerability in n/a, published on 22 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an administrator's bad configuration containing a malformed request URI caused the server to return an empty reply instead of a valid HTTP response to the client.

Weakness: CWE-125

Which versions are affected by CVE-2022-34037?

It affects 1 product.

Products include Caddyserver Caddy.

How do I fix CVE-2022-34037?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-34037 being exploited?

There is no known exploitation of CVE-2022-34037 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2018-21246 Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication Critical 9.8
• CVE-2026-27590 Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport High 8.9
• CVE-2026-27586 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed High 8.8
• CVE-2026-45135 Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files High 8.1
• CVE-2026-52845 Caddy: FastCGI header normalization bypass in `forward_auth copy_headers` High 8.1

Sources

• CVE record
• NVD
• OSV
• How this page is made

Also known as openSUSE-SU-2022:10080-1, openSUSE-SU-2024:12220-1.