Skip to content
Fencer Vulns
high 7.5

CVE-2022-34037 json

Withdrawn Advisory: Out-of-bounds Read can lead to client side denial of service

published 2022-07-22 4 y ago modified 2026-08-07 3 mo ago also GHSA-m7gr-5w5g-36jf , EUVD-2022-6374

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits
0
none known

Summary

An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an administrator's bad configuration containing a malformed request URI caused the server to return an empty reply instead of a valid HTTP response to the client.

Patch / fix

  • caddy openSUSE Tumbleweed 2.5.2-2.1
  • caddy Package Hub 15 SP4, openSUSE Leap 15.4 2.5.2-bp154.2.8.1

opensuse advisories openSUSE-SU-2024:12220-1openSUSE-SU-2022:10080-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-34037 updated

caddy: oob read allows for DoS

  • Red Hat Migration Toolkit for Containers rhmtc/openshift-velero-plugin-rhel8, rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-velero-plugin-for-aws-rhel8, rhmtc/openshift-migration-velero-plugin-for-gcp-rhel8, rhmtc/openshift-migration-velero-restic-restore-helper-rhel8, rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8 Red Hat OpenShift API for Data Protection oadp/oadp-rhel8-operator, oadp/oadp-velero-plugin-rhel8, oadp/oadp-velero-plugin-for-aws-rhel8, oadp/oadp-velero-plugin-for-csi-rhel8, oadp/oadp-kubevirt-velero-plugin-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/subctl-rhel9, rhacm2/rcm-controller-rhel8, rhacm2/lighthouse-agent-rhel9, rhacm2/search-aggregator-rhel8, rhacm2/management-ingress-rhel8, rhacm2/submariner-rhel8-operator, +2 more Red Hat OpenShift Container Platform 4 openshift4/ose-pod, openshift4/ose-tests, csi-driver-nfs-container, openshift4/ose-hyperkube, openshift4/ose-installer, openshift4/ose-sdn-rhel9, +29 more Red Hat Openshift Container Storage 4 ocs4/cephcsi-rhel8, ocs4/mcg-rhel8-operator, ocs4/ocs-rhel8-operator, ocs4/rook-ceph-rhel8-operator Red Hat Openshift Data Foundation 4 odf4/mcg-rhel9-operator, odf4/ocs-rhel9-operator, odf4/odf-rhel8-operator, odf4/odf-multicluster-rhel9-operator
    +2 more products
    Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/gitops-rhel8, openshift-gitops-1/applicationset-rhel8 Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-rhel8-operator
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.18% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/caddyserver/caddy/issues/4775 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.