Caddyserver vulnerabilities

Products

• Caddy 24

Newest

• caddyserver caddy Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through CVE-2026-55458 Fix available 2.9 LowOctober 28, 2026
• caddyserver caddy Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation CVE-2026-92700 6.3 MediumSeptember 17, 2026
• caddyserver caddy Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS CVE-2026-92284 6.9 MediumSeptember 17, 2026
• caddyserver caddy Caddy: rewrite placeholder re-expansion CVE-2026-77281 Fix available 6.5 MediumSeptember 17, 2026
• caddyserver caddy Caddy: stripHTML template function bypass CVE-2026-52846 Fix available 4.2 MediumJune 16, 2026
• caddyserver caddy, red hat hardened images +1 more Caddy: FastCGI header normalization bypass in `forward_auth copy_headers` CVE-2026-52845 Fix available 8.1 HighJune 16, 2026
• caddyserver caddy Caddy: Windows `file_server` path authorization bypass via encoded backslash CVE-2026-52844 Fix available 7.5 HighJune 16, 2026
• caddyserver caddy Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization CVE-2026-45692 Fix available 5.4 MediumMay 19, 2026
• caddyserver caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files CVE-2026-45135 Fix available 8.1 HighMay 18, 2026
• caddyserver caddy Caddy: vars_regexp double-expands user input, leaking env vars and files CVE-2026-30852 Fix available 5.5 MediumMarch 6, 2026
• caddyserver caddy Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation CVE-2026-30851 Fix available 8.1 HighMarch 6, 2026
• caddyserver caddy Caddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport CVE-2026-27590 Fix available 8.9 HighFebruary 24, 2026
• caddyserver caddy Caddy vulnerable to cross-origin config application via local admin API /load (caddy) CVE-2026-27589 Fix available 6.9 MediumFebruary 24, 2026
• caddyserver caddy Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass CVE-2026-27588 Fix available 7.7 HighFebruary 24, 2026
• caddyserver caddy Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass CVE-2026-27587 Fix available 7.7 HighFebruary 24, 2026
• caddyserver caddy Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed CVE-2026-27586 Fix available 8.8 HighFebruary 24, 2026
• caddyserver caddy Caddy's improper sanitization of glob characters in file matcher may lead to bypassing security protections CVE-2026-27585 Fix available 6.9 MediumFebruary 24, 2026
• caddyserver caddy Header spoofing in caddy-geo-ip CVE-2023-50463 6.5 MediumDecember 10, 2023
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• caddyserver caddy Open Redirect in Caddy CVE-2022-28923 Fix available 6.1 MediumFebruary 6, 2023
• caddyserver caddy Withdrawn Advisory: Out-of-bounds Read can lead to client side denial of service CVE-2022-34037 Fix availableDisputed 7.5 HighJuly 22, 2022
• caddyserver caddy Open redirect in caddy CVE-2022-29718 Fix available 6.1 MediumJune 2, 2022
• caddyserver caddy Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication CVE-2018-21246 Fix available 9.8 CriticalJune 15, 2020
• caddyserver caddy Caddy allows enumeration of Certificates and Hostnames CVE-2018-19148 Fix available 3.7 LowNovember 10, 2018