Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority HIGH 80
Caddy is an extensible server platform that uses TLS by default.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.00614 · Published 2026-02-24 · Fixed in 2.11.1 CWE-180
Priority HIGH 77
Caddy is an extensible server platform that uses TLS by default.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00295 · Published 2026-02-24 · Fixed in 2.11.1 CWE-755
Priority HIGH 73
Caddy is an extensible server platform that uses TLS by default.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00285 · Published 2026-03-07 · Fixed in 2.11.2 CWE-287
Priority HIGH 73
Caddy is an extensible server platform that uses TLS by default.
CVSS 4.0HIGH 7.7· Network · No auth · No interaction · EPSS 0.00425 · Published 2026-02-24 · Fixed in 2.11.1 CWE-178
Priority HIGH 73
Caddy is an extensible server platform that uses TLS by default.
CVSS 4.0HIGH 7.7· Network · No auth · No interaction · EPSS 0.00425 · Published 2026-02-24 · Fixed in 2.11.1 CWE-178
Priority HIGH 72
Caddy is an extensible server platform that uses TLS by default.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00619 · Published 2026-06-23 · Fixed in 2.11.4 CWE-22
Priority HIGH 70
Caddy is an extensible server platform that uses TLS by default.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00388 · Published 2026-09-23 · No fix listed CWE-770
Priority HIGH 70
Caddy is an extensible server platform that uses TLS by default.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00445 · Published 2026-06-23 · Fixed in 2.11.4 CWE-287
Priority HIGH 70
Caddy is an extensible server platform that uses TLS by default.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00676 · Published 2026-06-23 · Fixed in 2.11.3 CWE-176
Priority MEDIUM 64
Caddy is an extensible server platform that uses TLS by default.
CVSS 4.0MEDIUM 5.5· Network · No auth · No interaction · EPSS 0.00466 · Published 2026-03-07 · Fixed in 2.11.2 CWE-200
Priority MEDIUM 64
Caddy is an extensible server platform that uses TLS by default.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00195 · Published 2026-02-24 · Fixed in 2.11.1 CWE-352
Priority MEDIUM 64
Caddy is an extensible server platform that uses TLS by default.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00367 · Published 2026-02-24 · Fixed in 2.11.1 CWE-20
Priority MEDIUM 61
Caddy is an extensible server platform that uses TLS by default.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00412 · Published 2026-09-23 · No fix listed CWE-178
Priority MEDIUM 58
Caddy is an extensible server platform that uses TLS by default.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00241 · Published 2026-06-23 · Fixed in 2.11.3 CWE-187
Priority MEDIUM 53
Caddy is an extensible server platform that uses TLS by default.
CVSS 3.1MEDIUM 4.2· Network · No auth · User interaction · EPSS 0.00248 · Published 2026-06-23 · Fixed in 2.11.4 CWE-116
Priority MEDIUM 47
Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02723 · Published 2020-06-15 · Fixed in 0.10.13 CWE-287
Priority LOW 35
Caddy is an extensible server platform that uses TLS by default.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00491 · Published 2026-09-17 · Fixed in 2.11.4 CWE-178
Priority LOW 35
An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01177 · Published 2022-07-22 · No fix listed CWE-125
Priority LOW 30
The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection…
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00655 · Published 2023-12-10 · No fix listed CWE-290
Priority LOW 30
Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01431 · Published 2023-02-06 · Fixed in 2.5.0-beta.1 CWE-601
Priority LOW 29
Caddy v2.4 was discovered to contain an open redirect vulnerability.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01076 · Published 2022-06-02 · Fixed in 2.5.0 CWE-601
Priority LOW 19
Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames.
CVSS 3.0LOW 3.7· Network · No auth · No interaction · EPSS 0.00862 · Published 2018-11-10 · Fixed in 0.11.1 CWE-200
Priority LOW 15
Caddy is an extensible server platform that uses TLS by default.
CVSS 4.0LOW 2.9· Network · No auth · No interaction · EPSS 0.00499 · Published 2026-11-05 · Fixed in 2.11.5 CWE-444
THREATIST.IORead the docs