Caddy (Caddyserver) - vulnerabilities (CVEs)
20 CVEs, 0 in the last 30 days, 144 known versions, newest CVE from 2026-09-23. Vendor: Caddyserver.
CVEs of Caddy
- CVE-2026-92700 - CVSS 6.3 (medium), 2026-09-23: Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden()…
- CVE-2026-92284 - CVSS 6.9 (medium), 2026-09-23: Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body…
- CVE-2026-77281 - CVSS 6.5 (medium), 2026-09-17: Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler…
- CVE-2026-45135 - CVSS 8.1 (high), 2026-06-23: Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in…
- CVE-2026-45692 - CVSS 5.4 (medium), 2026-06-23: Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree…
- CVE-2026-52845 - CVSS 8.1 (high), 2026-06-23: Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header…
- CVE-2026-52844 - CVSS 7.5 (high), 2026-06-23: Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside…
- CVE-2026-52846 - CVSS 4.2 (medium), 2026-06-23: Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags…
- CVE-2026-30852 - CVSS 7.5 (high), 2026-03-07: Caddy is an extensible server platform that uses TLS by default. From version 2.7.5 to before version 2.11.2, the vars_regexp matcher in vars.go:337…
- CVE-2026-30851 - CVSS 8.8 (high), 2026-03-07: Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip…
- CVE-2026-27590 - CVSS 9.8 (critical), 2026-02-24: Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a…
- CVE-2026-27589 - CVSS 6.9 (medium), 2026-02-24: Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (default listen `127.0.0.1:2019`) exposes…
- CVE-2026-27588 - CVSS 9.1 (critical), 2026-02-24: Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request matcher is documented as…
- CVE-2026-27586 - CVSS 9.1 (critical), 2026-02-24: Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `ClientAuthentication.provision()` cause…
- CVE-2026-27585 - CVSS 6.9 (medium), 2026-02-24: Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize…
- CVE-2026-27587 - CVSS 9.1 (critical), 2026-02-24: Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request matcher is intended to be…
- CVE-2023-50463 - CVSS 6.5 (medium), 2023-12-10: The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof their source IP…
- CVE-2023-44487 - CVSS 7.5 (high), 2023-10-10: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
- CVE-2022-28923 - CVSS 6.1 (medium), 2023-02-06: Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs.
- CVE-2022-34037 - CVSS 7.5 (high), 2022-07-22: An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via…
- CVE-2022-29718 - CVSS 6.1 (medium), 2022-06-02: Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to…
- CVE-2018-21246 - CVSS 9.8 (critical), 2020-06-15: Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.
- CVE-2018-19148 - CVSS 3.7 (low), 2018-11-10: Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames. Specifically, when…
