TI-2026-32968 Aliases CVE-2026-45135 GHSA-m675-2p33-xv9g

Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

HIGH 70CWE-176Published 2026-06-23 · Updated 2026-06-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non-.php (or other configured split_path extension) file as a script. In any deployment where the attacker can place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This vulnerability is fixed in 2.11.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00676 52nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed caddy (caddyserver): 2.11.3github.com/caddyserver/caddy/v2 (Go): 2.11.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
caddyserver	caddy	2.7.0 to before 2.11.3	2.11.3	Patch available	CNA
—	github.com/caddyserver/caddy/v2 (Go)	2.7.0 to before 2.11.3	2.11.3	Patch available	GHSA-m675-2p33-xv9g

caddy Vendorcaddyserver Affected 2.7.0 to before 2.11.3 Fixed in 2.11.3 Patch available CNA
github.com/caddyserver/caddy/v2 (Go) Vendor— Affected 2.7.0 to before 2.11.3 Fixed in 2.11.3 Patch available GHSA-m675-2p33-xv9g

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:caddyserver:caddy::::::::	2.7.0 to before 2.11.3	Vulnerable	caddyserver

cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:* Versions 2.7.0 to before 2.11.3 Vulnerable ·caddyserver

Remediation

Fix · CNA caddy (caddyserver) Fixed in 2.11.3
Fix · GHSA-m675-2p33-xv9g github.com/caddyserver/caddy/v2 (Go) Fixed in 2.11.3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product

Red Hat Hardened Images

Timeline

2026-10-02 Threatist record created from CVE-2026-45135
2026-10-03 Alias added: GHSA-m675-2p33-xv9g

References

Exploit 1

https://github.com/caddyserver/caddy/security/advisories/GHSA-m675-2p33-xv9g

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-45135

Other 3

TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2026-21978 Improper input validation in caddyserver caddy CVSS 4.0HIGH 8.9
TI-2026-21974 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed CVSS 4.0HIGH 8.8
TI-2026-23680 Improper authentication in caddyserver caddy CVSS 3.1HIGH 8.8
TI-2026-21976 Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass CVSS 4.0HIGH 7.7
TI-2026-21975 Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass CVSS 4.0HIGH 7.7

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences