Vulnerabilities

TI-2026-85642 CVE-2026-55458

Caddy leaks hop-by-hop headers through WebSocket upgrade responses

LOW 15

Caddy is an extensible server platform that uses TLS by default.

CVSS 4.0LOW 2.9 Network No auth No interaction EPSS 0.00499 Published 2026-11-05 Fixed in 2.11.5 CWE-444

TI-2026-62476 CVE-2026-92700

Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation

MEDIUM 61

Caddy is an extensible server platform that uses TLS by default.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00412 Published 2026-09-23 No fix listed CWE-178

TI-2026-62286 CVE-2026-92284

Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS

HIGH 70

Caddy is an extensible server platform that uses TLS by default.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00388 Published 2026-09-23 No fix listed CWE-770

TI-2026-53958 CVE-2026-77281 · GHSA-j8px-rmrx-76h9

Caddy: rewrite placeholder re-expansion

LOW 35

Caddy is an extensible server platform that uses TLS by default.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00491 Published 2026-09-17 Fixed in 2.11.4 CWE-178

TI-2026-32968 CVE-2026-45135 · GHSA-m675-2p33-xv9g

Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

HIGH 70

Caddy is an extensible server platform that uses TLS by default.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00676 Published 2026-06-23 Fixed in 2.11.3 CWE-176

TI-2026-33434 CVE-2026-45692 · GHSA-x5w9-xh9r-mvfc

Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization

MEDIUM 58

Caddy is an extensible server platform that uses TLS by default.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00241 Published 2026-06-23 Fixed in 2.11.3 CWE-187

TI-2026-37953 CVE-2026-52845 · GHSA-f59h-q822-g45g

Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

HIGH 70

Caddy is an extensible server platform that uses TLS by default.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00445 Published 2026-06-23 Fixed in 2.11.4 CWE-287

TI-2026-37952 CVE-2026-52844 · GHSA-qrp7-cvwr-j2c6

Caddy: Windows `file_server` path authorization bypass via encoded backslash

HIGH 72

Caddy is an extensible server platform that uses TLS by default.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00619 Published 2026-06-23 Fixed in 2.11.4 CWE-22

TI-2026-37954 CVE-2026-52846 · GHSA-vcc4-2c75-vc9v

Caddy: stripHTML template function bypass

MEDIUM 53

Caddy is an extensible server platform that uses TLS by default.

CVSS 3.1MEDIUM 4.2 Network No auth User interaction EPSS 0.00248 Published 2026-06-23 Fixed in 2.11.4 CWE-116

TI-2026-23680 CVE-2026-30851 · GHSA-7r4p-vjf4-gxv4

Improper authentication in caddyserver caddy

HIGH 73

Caddy is an extensible server platform that uses TLS by default.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00285 Published 2026-03-07 Fixed in 2.11.2 CWE-287

TI-2026-23681 CVE-2026-30852 · GHSA-m2w3-8f23-hxxf

Caddy: vars_regexp double-expands user input, leaking env vars and files

MEDIUM 64

Caddy is an extensible server platform that uses TLS by default.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00466 Published 2026-03-07 Fixed in 2.11.2 CWE-200

TI-2026-21978 CVE-2026-27590 · GHSA-5r3v-vc8m-m96g

Improper input validation in caddyserver caddy

HIGH 80

Caddy is an extensible server platform that uses TLS by default.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00614 Published 2026-02-24 Fixed in 2.11.1 CWE-180

TI-2026-21977 CVE-2026-27589 · GHSA-879p-475x-rqh2

Caddy vulnerable to cross-origin config application via local admin API /load (caddy)

MEDIUM 64

Caddy is an extensible server platform that uses TLS by default.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00195 Published 2026-02-24 Fixed in 2.11.1 CWE-352

TI-2026-21976 CVE-2026-27588 · GHSA-x76f-jf84-rqj8

Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass

HIGH 73

Caddy is an extensible server platform that uses TLS by default.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00425 Published 2026-02-24 Fixed in 2.11.1 CWE-178

TI-2026-21975 CVE-2026-27587 · GHSA-g7pc-pc7g-h8jh

Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass

HIGH 73

Caddy is an extensible server platform that uses TLS by default.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00425 Published 2026-02-24 Fixed in 2.11.1 CWE-178

TI-2026-21974 CVE-2026-27586 · GHSA-hffm-g8v7-wrv7

Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed

HIGH 77

Caddy is an extensible server platform that uses TLS by default.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00295 Published 2026-02-24 Fixed in 2.11.1 CWE-755

TI-2026-21973 CVE-2026-27585 · GHSA-4xrr-hq4w-6vf4

Caddy's improper sanitization of glob characters in file matcher may lead to bypassing security protections

MEDIUM 64

Caddy is an extensible server platform that uses TLS by default.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00367 Published 2026-02-24 Fixed in 2.11.1 CWE-20

TI-2023-27607 CVE-2023-50463 · GHSA-rxg9-hgq7-8pwx

The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header…

LOW 30

The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00655 Published 2023-12-10 No fix listed CWE-290

TI-2023-23979 CVE-2023-44487 · GHSA-qppj-fm5r-hxr3

The HTTP/2 protocol allows a denial of service (server resource consumption) because…

CRITICAL 90KEV

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.99999 Published 2023-10-10 Partial fix · 1.28.0, 0.17.0 +9 CWE-400

TI-2022-11532 CVE-2022-28923 · GHSA-qpm3-vr34-h8w8

Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows…

LOW 30

Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01431 Published 2023-02-06 Fixed in 2.5.0-beta.1 CWE-601

TI-2022-15015 CVE-2022-34037

An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in…

LOW 35

An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01177 Published 2022-07-22 No fix listed CWE-125

TI-2022-12117 CVE-2022-29718 · GHSA-2927-hv3p-f3vp

Caddy v2.4 was discovered to contain an open redirect vulnerability.

LOW 29

Caddy v2.4 was discovered to contain an open redirect vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01076 Published 2022-06-02 Fixed in 2.5.0 CWE-601

TI-2018-15208 CVE-2018-21246 · GHSA-gr7w-x2jp-3xgw

Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an…

MEDIUM 47

Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02723 Published 2020-06-15 Fixed in 0.10.13 CWE-287

TI-2018-13579 CVE-2018-19148 · GHSA-jf2w-mq6r-56v8

Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it…

LOW 19

Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames.

CVSS 3.0LOW 3.7 Network No auth No interaction EPSS 0.00862 Published 2018-11-10 Fixed in 0.11.1 CWE-200

Vulnerabilities

Filters