CVE catalog

CVE-2023-45142

Security update for caddy

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Oct 12, 2023, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.61% · Oct 27, 2026

A memory leak was found in the otelhttp handler of open-telemetry. This flaw allows a remote, unauthenticated attacker to exhaust the server's memory by sending many malicious requests, affecting the availability. opentelemetry: DoS vulnerability in otelhttp While no authentication is required, there are a significant number of non-default factors which prevent widespread exploitation of this flaw. For a service to be affected, all of the following must be true: * The go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp package must be in use * Configured a metrics pipeline which uses the otelhttp.NewHandler wrapper function * No filtering of unknown HTTP methods or user agents at a higher level (such as Content Delivery Network/Load Balancer/etc...) Due to the limited attack surface, Red Hat Product Security rates the impact as Moderate. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Go	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	Not reported	`0.44.0`	fixed
Go	go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful	Not reported	`0.44.0`	fixed
Go	go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin	Not reported	`0.44.0`	fixed
Go	go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux	Not reported	`0.44.0`	fixed
Go	go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho	Not reported	`0.44.0`	fixed
Go	go.opentelemetry.io/contrib/instrumentation/gopkg.in/macaron.v1/otelmacaron	Not reported	`0.44.0`	fixed
Go	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace	Not reported	`0.44.0`	fixed
Suse	docker	linux micro 6.1	`27.5.1_ce-slfo.1.1_1.1`	fixed
Suse	docker	linux micro 6.0	`26.1.5_ce-1.1`	fixed
Suse	caddy	package hub 15 sp6	`2.8.4-bp156.3.3.1`	fixed
Opensuse	caddy	leap 15.6	`2.8.4-bp156.3.3.1`	fixed
Opensuse	golang-github-prometheus-prometheus	tumbleweed	`2.53.0-3.1`	fixed
Opensuse	containerd	tumbleweed	`1.7.21-1.1`	fixed
Opensuse	caddy	tumbleweed	`2.7.6-1.1`	fixed
Suse	docker	linux enterprise micro 5.3	`26.1.5_ce-150000.212.1`	fixed
Suse	docker	linux enterprise micro 5.4	`26.1.5_ce-150000.212.1`	fixed
Suse	docker	linux enterprise micro 5.5	`26.1.5_ce-150000.212.1`	fixed
Suse	docker	linux enterprise module for containers 15 sp5	`26.1.5_ce-150000.212.1`	fixed
Suse	docker	linux enterprise module for containers 15 sp6	`26.1.5_ce-150000.212.1`	fixed
Suse	docker	linux enterprise high performance computing 15 sp2-ltss	`26.1.5_ce-150000.212.1`	fixed
Suse	docker	linux enterprise high performance computing 15 sp3-ltss	`26.1.5_ce-150000.212.1`	fixed
Suse	docker	linux enterprise high performance computing 15 sp4-espos	`26.1.5_ce-150000.212.1`	fixed
Suse	docker	linux enterprise high performance computing 15 sp4-ltss	`26.1.5_ce-150000.212.1`	fixed
Suse	docker	linux enterprise server 15 sp2-ltss	`26.1.5_ce-150000.212.1`	fixed
Suse	docker	linux enterprise server 15 sp3-ltss	`26.1.5_ce-150000.212.1`	fixed
Suse	docker	linux enterprise server 15 sp4-ltss	`26.1.5_ce-150000.212.1`	fixed
Suse	docker	linux enterprise server for sap applications 15 sp2	`26.1.5_ce-150000.212.1`	fixed
Suse	docker	linux enterprise server for sap applications 15 sp3	`26.1.5_ce-150000.212.1`	fixed
Suse	docker	linux enterprise server for sap applications 15 sp4	`26.1.5_ce-150000.212.1`	fixed
Suse	docker	linux enterprise micro 5.1	`26.1.5_ce-150000.212.1`	fixed
Suse	docker	linux enterprise micro 5.2	`26.1.5_ce-150000.212.1`	fixed
Suse	docker	enterprise storage 7.1	`26.1.5_ce-150000.212.1`	fixed
Opensuse	docker	leap micro 5.5	`26.1.5_ce-150000.212.1`	fixed
Opensuse	docker	leap 15.5	`26.1.5_ce-150000.212.1`	fixed
Opensuse	docker	leap 15.6	`26.1.5_ce-150000.212.1`	fixed
Opensuse	docker	tumbleweed	`26.1.5_ce-2.1`	fixed
Suse	docker	linux enterprise server 12 sp5-ltss	`26.1.5_ce-98.120.1`	fixed
Suse	docker	linux enterprise server ltss extended security 12 sp5	`26.1.5_ce-98.120.1`	fixed
Suse	containerd	linux enterprise module for containers 12	`1.7.21-16.94.1`	fixed
Suse	golang-github-prometheus-prometheus	manager client tools 15	`2.45.6-150000.3.56.1`	fixed
Suse	rhnlib	manager client tools 15	`5.0.4-150000.3.46.1`	fixed
Suse	spacecmd	manager client tools 15	`5.0.9-150000.3.124.1`	fixed
Suse	uyuni-tools	manager client tools 15	`0.1.21-150000.1.8.2`	fixed
Suse	uyuni-tools	manager client tools for sle micro 5	`0.1.21-150000.1.8.2`	fixed
Opensuse	spacecmd	leap 15.5	`5.0.9-150000.3.124.1`	fixed
Opensuse	spacecmd	leap 15.6	`5.0.9-150000.3.124.1`	fixed
Suse	golang-github-prometheus-prometheus	manager client tools 12	`2.45.6-1.53.1`	fixed
Suse	rhnlib	manager client tools 12	`5.0.4-21.52.1`	fixed
Suse	spacecmd	manager client tools 12	`5.0.9-38.147.1`	fixed
Suse	uyuni-tools	manager client tools 12	`0.1.21-1.8.1`	fixed
Suse	caddy	package hub 15 sp5	`2.8.4-bp155.2.3.1`	fixed
Opensuse	caddy	leap 15.5	`2.8.4-bp155.2.3.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Go	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	Go	Not reported	`0.44.0`	Not reported	GHSA-RCJV-MGP8-QVMR	Not reported
Go	go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful	Go	Not reported	`0.44.0`	Not reported	GHSA-RCJV-MGP8-QVMR	Not reported
Go	go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin	Go	Not reported	`0.44.0`	Not reported	GHSA-RCJV-MGP8-QVMR	Not reported
Go	go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux	Go	Not reported	`0.44.0`	Not reported	GHSA-RCJV-MGP8-QVMR	Not reported
Go	go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho	Go	Not reported	`0.44.0`	Not reported	GHSA-RCJV-MGP8-QVMR	Not reported
Go	go.opentelemetry.io/contrib/instrumentation/gopkg.in/macaron.v1/otelmacaron	Go	Not reported	`0.44.0`	Not reported	GHSA-RCJV-MGP8-QVMR	Not reported
Go	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace	Go	Not reported	`0.44.0`	Not reported	GHSA-RCJV-MGP8-QVMR	Not reported
Suse	docker	rpm	linux micro 6.1	`27.5.1_ce-slfo.1.1_1.1`	Not reported	SUSE-SU-2025:20259-1	Not reported
Suse	docker	rpm	linux micro 6.0	`26.1.5_ce-1.1`	Not reported	SUSE-SU-2025:20110-1	Not reported
Suse	caddy	rpm	package hub 15 sp6	`2.8.4-bp156.3.3.1`	Not reported	OPENSUSE-SU-2024:0220-1	Not reported
Opensuse	caddy	rpm	leap 15.6	`2.8.4-bp156.3.3.1`	Not reported	OPENSUSE-SU-2024:0220-1	Not reported
Opensuse	golang-github-prometheus-prometheus	rpm	tumbleweed	`2.53.0-3.1`	Not reported	OPENSUSE-SU-2024:14232-1	Not reported
Opensuse	containerd	rpm	tumbleweed	`1.7.21-1.1`	Not reported	OPENSUSE-SU-2024:14320-1	Not reported
Opensuse	caddy	rpm	tumbleweed	`2.7.6-1.1`	Not reported	OPENSUSE-SU-2024:13495-1	Not reported
Suse	docker	rpm	linux enterprise micro 5.3	`26.1.5_ce-150000.212.1`	Not reported	SUSE-SU-2024:4360-1	Not reported
Suse	docker	rpm	linux enterprise micro 5.4	`26.1.5_ce-150000.212.1`	Not reported	SUSE-SU-2024:4360-1	Not reported
Suse	docker	rpm	linux enterprise micro 5.5	`26.1.5_ce-150000.212.1`	Not reported	SUSE-SU-2024:4360-1	Not reported
Suse	docker	rpm	linux enterprise module for containers 15 sp5	`26.1.5_ce-150000.212.1`	Not reported	SUSE-SU-2024:4360-1	Not reported
Suse	docker	rpm	linux enterprise module for containers 15 sp6	`26.1.5_ce-150000.212.1`	Not reported	SUSE-SU-2024:4360-1	Not reported
Suse	docker	rpm	linux enterprise high performance computing 15 sp2-ltss	`26.1.5_ce-150000.212.1`	Not reported	SUSE-SU-2024:4360-1	Not reported
Suse	docker	rpm	linux enterprise high performance computing 15 sp3-ltss	`26.1.5_ce-150000.212.1`	Not reported	SUSE-SU-2024:4360-1	Not reported
Suse	docker	rpm	linux enterprise high performance computing 15 sp4-espos	`26.1.5_ce-150000.212.1`	Not reported	SUSE-SU-2024:4360-1	Not reported
Suse	docker	rpm	linux enterprise high performance computing 15 sp4-ltss	`26.1.5_ce-150000.212.1`	Not reported	SUSE-SU-2024:4360-1	Not reported
Suse	docker	rpm	linux enterprise server 15 sp2-ltss	`26.1.5_ce-150000.212.1`	Not reported	SUSE-SU-2024:4360-1	Not reported
Suse	docker	rpm	linux enterprise server 15 sp3-ltss	`26.1.5_ce-150000.212.1`	Not reported	SUSE-SU-2024:4360-1	Not reported
Suse	docker	rpm	linux enterprise server 15 sp4-ltss	`26.1.5_ce-150000.212.1`	Not reported	SUSE-SU-2024:4360-1	Not reported
Suse	docker	rpm	linux enterprise server for sap applications 15 sp2	`26.1.5_ce-150000.212.1`	Not reported	SUSE-SU-2024:4360-1	Not reported
Suse	docker	rpm	linux enterprise server for sap applications 15 sp3	`26.1.5_ce-150000.212.1`	Not reported	SUSE-SU-2024:4360-1	Not reported
Suse	docker	rpm	linux enterprise server for sap applications 15 sp4	`26.1.5_ce-150000.212.1`	Not reported	SUSE-SU-2024:4360-1	Not reported
Suse	docker	rpm	linux enterprise micro 5.1	`26.1.5_ce-150000.212.1`	Not reported	SUSE-SU-2024:4360-1	Not reported
Suse	docker	rpm	linux enterprise micro 5.2	`26.1.5_ce-150000.212.1`	Not reported	SUSE-SU-2024:4360-1	Not reported
Suse	docker	rpm	enterprise storage 7.1	`26.1.5_ce-150000.212.1`	Not reported	SUSE-SU-2024:4360-1	Not reported
Opensuse	docker	rpm	leap micro 5.5	`26.1.5_ce-150000.212.1`	Not reported	SUSE-SU-2024:4360-1	Not reported
Opensuse	docker	rpm	leap 15.5	`26.1.5_ce-150000.212.1`	Not reported	SUSE-SU-2024:4360-1	Not reported
Opensuse	docker	rpm	leap 15.6	`26.1.5_ce-150000.212.1`	Not reported	SUSE-SU-2024:4360-1	Not reported
Opensuse	docker	rpm	tumbleweed	`26.1.5_ce-2.1`	Not reported	OPENSUSE-SU-2024:14321-1	Not reported
Suse	docker	rpm	linux enterprise server 12 sp5-ltss	`26.1.5_ce-98.120.1`	Not reported	SUSE-SU-2024:4319-1	Not reported
Suse	docker	rpm	linux enterprise server ltss extended security 12 sp5	`26.1.5_ce-98.120.1`	Not reported	SUSE-SU-2024:4319-1	Not reported
Suse	containerd	rpm	linux enterprise module for containers 12	`1.7.21-16.94.1`	Not reported	SUSE-SU-2024:3188-1	Not reported
Suse	golang-github-prometheus-prometheus	rpm	manager client tools 15	`2.45.6-150000.3.56.1`	Not reported	SUSE-SU-2024:3267-1	Not reported
Suse	rhnlib	rpm	manager client tools 15	`5.0.4-150000.3.46.1`	Not reported	SUSE-SU-2024:3267-1	Not reported
Suse	spacecmd	rpm	manager client tools 15	`5.0.9-150000.3.124.1`	Not reported	SUSE-SU-2024:3267-1	Not reported
Suse	uyuni-tools	rpm	manager client tools 15	`0.1.21-150000.1.8.2`	Not reported	SUSE-SU-2024:3267-1	Not reported
Suse	uyuni-tools	rpm	manager client tools for sle micro 5	`0.1.21-150000.1.8.2`	Not reported	SUSE-SU-2024:3267-1	Not reported
Opensuse	spacecmd	rpm	leap 15.5	`5.0.9-150000.3.124.1`	Not reported	SUSE-SU-2024:3267-1	Not reported
Opensuse	spacecmd	rpm	leap 15.6	`5.0.9-150000.3.124.1`	Not reported	SUSE-SU-2024:3267-1	Not reported
Suse	golang-github-prometheus-prometheus	rpm	manager client tools 12	`2.45.6-1.53.1`	Not reported	SUSE-SU-2024:3266-1	Not reported
Suse	rhnlib	rpm	manager client tools 12	`5.0.4-21.52.1`	Not reported	SUSE-SU-2024:3266-1	Not reported
Suse	spacecmd	rpm	manager client tools 12	`5.0.9-38.147.1`	Not reported	SUSE-SU-2024:3266-1	Not reported
Suse	uyuni-tools	rpm	manager client tools 12	`0.1.21-1.8.1`	Not reported	SUSE-SU-2024:3266-1	Not reported
Suse	caddy	rpm	package hub 15 sp5	`2.8.4-bp155.2.3.1`	Not reported	OPENSUSE-SU-2024:0211-1	Not reported
Opensuse	caddy	rpm	leap 15.5	`2.8.4-bp155.2.3.1`	Not reported	OPENSUSE-SU-2024:0211-1	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[caddy-bash-completion]Unknown
Source package: [caddy]
Details (1)
- 2.11.4-1.3 · noarch · tumbleweed
  Unknown · Fixed: 2.7.6-1.1
  Version impact unknown
  pypi · caddy · opensuse · tumbleweed
[caddy-fish-completion]Unknown
Source package: [caddy]
Details (1)
- 2.11.4-1.3 · noarch · tumbleweed
  Unknown · Fixed: 2.7.6-1.1
  Version impact unknown
  pypi · caddy · opensuse · tumbleweed
[caddy-zsh-completion]Unknown
Source package: [caddy]
Details (1)
- 2.11.4-1.3 · noarch · tumbleweed
  Unknown · Fixed: 2.7.6-1.1
  Version impact unknown
  pypi · caddy · opensuse · tumbleweed
[containerd-ctr]Unknown
Source package: [containerd]
Details (1)
- 1.7.33-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 1.7.21-1.1
  Version impact unknown
  pypi · containerd · opensuse · tumbleweed
[containerd-devel]Unknown
Source package: [containerd]
Details (1)
- 1.7.33-1.3 · noarch · tumbleweed
  Unknown · Fixed: 1.7.21-1.1
  Version impact unknown
  pypi · containerd · opensuse · tumbleweed
[docker-bash-completion]Unknown
Source package: [docker]
Details (1)
- 29.4.0_ce-40.3 · noarch · tumbleweed
  Unknown · Fixed: 26.1.5_ce-2.1
  Version impact unknown
  pypi · docker · opensuse · tumbleweed
[docker-buildx]Unknown
Source package: [docker]
Details (1)
- 0.33.0-40.3 · x86_64 · tumbleweed
  Unknown · Fixed: 26.1.5_ce-2.1
  Version impact unknown
  pypi · docker · opensuse · tumbleweed
[docker-fish-completion]Unknown
Source package: [docker]
Details (1)
- 29.4.0_ce-40.3 · noarch · tumbleweed
  Unknown · Fixed: 26.1.5_ce-2.1
  Version impact unknown
  pypi · docker · opensuse · tumbleweed
[docker-rootless-extras]Unknown
Source package: [docker]
Details (1)
- 29.4.0_ce-40.3 · noarch · tumbleweed
  Unknown · Fixed: 26.1.5_ce-2.1
  Version impact unknown
  pypi · docker · opensuse · tumbleweed
[docker-zsh-completion]Unknown
Source package: [docker]
Details (1)
- 29.4.0_ce-40.3 · noarch · tumbleweed
  Unknown · Fixed: 26.1.5_ce-2.1
  Version impact unknown
  pypi · docker · opensuse · tumbleweed
[caddy]Fixed
Source package: [caddy]
Details (1)
- 2.11.4-1.3 · x86_64 · tumbleweed
  Fixed · Fixed: 2.7.6-1.1
  pypi · caddy · opensuse · tumbleweed
[containerd]Fixed
Source package: [containerd]
Details (1)
- 1.7.33-1.3 · x86_64 · tumbleweed
  Fixed · Fixed: 1.7.21-1.1
  pypi · containerd · opensuse · tumbleweed
[docker]Fixed
Source package: [docker]
Details (1)
- 29.4.0_ce-40.3 · x86_64 · tumbleweed
  Fixed · Fixed: 26.1.5_ce-2.1
  pypi · docker · opensuse · tumbleweed
[golang-github-prometheus-prometheus]Fixed
Source package: [golang-github-prometheus-prometheus]
Details (1)
- 3.13.2-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 2.53.0-3.1
  pypi · golang-github-prometheus-prometheus · opensuse · tumbleweed

Observed: Oct 28, 2026, 5:43:41 PM UTC

References

[CERT-Bund public advisories] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]