Skip to content
OpenAdvisories

Package · Wolfi

caddy-src

27 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-64702 Public exploit

    quic-go HTTP/3 QPACK Header Expansion DoS

    quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large head…

    quic-go quic-go k3s k3s-static Debian Ubuntu Wolfi Go
  • Medium 4.4
    CVE-2025-22870 Public exploit

    HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

    Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be prox…

    Go standard library golang.org/x/net net/http golang.org/x/net/proxy Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 6.5
    CVE-2024-53259 Public exploit

    quic-go affected by an ICMP Packet Too Large Injection Attack on Linux

    quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IP_PMTUDISC_DO, the kernel would then return a "message too large" error on sendmsg, i.e. when quic-…

    quic-go quic-go k3s k3s-static Debian Ubuntu Azure Linux Wolfi Go