caddy vulnerabilities (Alpine)
9 vulnerabilities.
-
caddyAlpine Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization 5.4 Medium -
caddyAlpine Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files 8.1 High -
caddyAlpine Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation 8.1 High -
caddyAlpine Caddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport 8.9 High -
caddyAlpine Caddy vulnerable to cross-origin config application via local admin API /load (caddy) 6.9 Medium -
caddyAlpine Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass 7.7 High -
caddyAlpine Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass 7.7 High -
caddyAlpine Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed 8.8 High -
caddyAlpine Caddy's improper sanitization of glob characters in file matcher may lead to bypassing security protections 6.9 Medium