Caddy Security Update: Gnoppix Issues Urgent Patch (GSA-6429-1)
The Gnoppix Security Team has released a critical update for the Caddy web server, fixing multiple vulnerabilities that could allow remote code execution or service disruption. Apply the update immediately to protect your systems.
The advisory, now designated GSA-6429-1, affects all Caddy installations on Gnoppix 24/25 (oldstable) and Gnoppix 26 (stable). The update resolves flaws in request handling that may be exploited by crafted HTTP traffic.
Vulnerabilities Addressed
- Remote code execution risk: Improper input validation in the Caddyfile parser could let an attacker execute arbitrary code with the server’s privileges.
- Denial of service via malformed requests: A separate issue permits memory exhaustion when processing specially crafted HTTP/2 headers.
Both issues are fixed in Caddy version 2.8.4-1+gnx1, uploaded to the Gnoppix repositories.
Recommended Action
Immediate upgrade required. If you cannot update right away, restrict network access to the Caddy service and enable a firewall. No workaround is available for the remote code execution flaw.
Upgrade command for versions using apt:
sudo apt update && sudo apt install --only-upgrade caddy
After installation, restart the Caddy service to load the patched binaries.
Background and Impact
Caddy is a popular, automatic-HTTPS web server used in production and testing environments. The affected versions were introduced in the previous Gnoppix (bookworm-based) release cycle. The Gnoppix Security team coordinates this advisory with upstream maintainers.
For full technical details, refer to the CVE listings linked from the original announcement. A follow-up update for Gnoppix 27 (testing) is expected within the next release cycle. - Please update your systems.