Description
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP4 | caddy | 2.5.1-bp154.2.5.1 | openSUSE-SU-2022:10007-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | caddy | 2.5.1-2.1 | openSUSE-SU-2024:12132-1 |
| openSUSE Leap 15.4 | caddy | 2.5.1-bp154.2.5.1 | openSUSE-SU-2022:10007-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/caddyserver/caddy | < 2.5.0 | 2.5.0 | GHSA-2927-hv3p-f3vp |
| Go | github.com/caddyserver/caddy/v2 | < 2.5.0 | 2.5.0 | GHSA-2927-hv3p-f3vp |
Advisories 2
- openSUSE-SU-2022:10007-1 Security update for caddy SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12132-1 caddy-2.5.1-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/caddyserver/caddy/pull/4499
- FEDORA-2023-a258bed79b vendor-advisory