github.com/caddyserver/caddy/v2
Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
View on Github
Activity
- Latest release
- 3mo ago
- Total releases
- 59
- Cadence
- ~25 days
- Last 12 months
- 7
Reach
- Stars
- 75.5k
Details
- First release
- Sep 13, 2019
| Version | Released | |
|---|---|---|
v2.11.4
patch
|
v2.11.4
patch
Dependencies (51)
+ 43 more |
|
v2.11.3
patch
3 CVEs
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev |
v2.11.3
patch
Dependencies (51)
+ 43 more |
|
v2.11.2
patch
7 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
GO-2026-5730
GHSA-wwhq-w58m-w29c
Jul 24, 2026
Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev |
v2.11.2
patch
Dependencies (50)
+ 42 more |
|
v2.11.1
patch
9 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
GO-2026-5730
GHSA-wwhq-w58m-w29c
Jul 24, 2026
Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-30852
GO-2026-4644
GHSA-m2w3-8f23-hxxf
Mar 10, 2026
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-30851
GO-2026-4639
GHSA-7r4p-vjf4-gxv4
Mar 10, 2026
Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev |
v2.11.1
patch
Dependencies (50)
+ 42 more |
|
v2.11.0
minor
15 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
GO-2026-5730
GHSA-wwhq-w58m-w29c
Jul 24, 2026
Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-30852
GO-2026-4644
GHSA-m2w3-8f23-hxxf
Mar 10, 2026
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-30851
GO-2026-4639
GHSA-7r4p-vjf4-gxv4
Mar 10, 2026
Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.11.0
minor
Dependencies (50)
+ 42 more |
|
v2.11.0-beta.2
pre
14 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-30852
GO-2026-4644
GHSA-m2w3-8f23-hxxf
Mar 10, 2026
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-30851
GO-2026-4639
GHSA-7r4p-vjf4-gxv4
Mar 10, 2026
Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.11.0-beta.2
pre
Dependencies (49)
+ 41 more |
|
v2.11.0-beta.1
pre
14 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-30852
GO-2026-4644
GHSA-m2w3-8f23-hxxf
Mar 10, 2026
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-30851
GO-2026-4639
GHSA-7r4p-vjf4-gxv4
Mar 10, 2026
Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.11.0-beta.1
pre
Dependencies (49)
+ 41 more |
|
v2.10.2
patch
14 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-30852
GO-2026-4644
GHSA-m2w3-8f23-hxxf
Mar 10, 2026
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-30851
GO-2026-4639
GHSA-7r4p-vjf4-gxv4
Mar 10, 2026
Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.10.2
patch
Dependencies (49)
+ 41 more |
|
v2.10.1
patch
14 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-30852
GO-2026-4644
GHSA-m2w3-8f23-hxxf
Mar 10, 2026
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-30851
GO-2026-4639
GHSA-7r4p-vjf4-gxv4
Mar 10, 2026
Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.10.1
patch
Dependencies (49)
+ 41 more |
|
v2.10.0
minor
14 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-30852
GO-2026-4644
GHSA-m2w3-8f23-hxxf
Mar 10, 2026
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-30851
GO-2026-4639
GHSA-7r4p-vjf4-gxv4
Mar 10, 2026
Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.10.0
minor
Dependencies (49)
+ 41 more |
|
v2.10.0-beta.4
pre
13 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-30852
GO-2026-4644
GHSA-m2w3-8f23-hxxf
Mar 10, 2026
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.10.0-beta.4
pre
Dependencies (49)
+ 41 more |
|
v2.10.0-beta.3
pre
13 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-30852
GO-2026-4644
GHSA-m2w3-8f23-hxxf
Mar 10, 2026
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.10.0-beta.3
pre
Dependencies (49)
+ 41 more |
|
v2.10.0-beta.2
pre
13 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-30852
GO-2026-4644
GHSA-m2w3-8f23-hxxf
Mar 10, 2026
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.10.0-beta.2
pre
Dependencies (49)
+ 41 more |
|
v2.10.0-beta.1
pre
13 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-30852
GO-2026-4644
GHSA-m2w3-8f23-hxxf
Mar 10, 2026
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.10.0-beta.1
pre
Dependencies (49)
+ 41 more |
|
v2.9.1
patch
13 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-30852
GO-2026-4644
GHSA-m2w3-8f23-hxxf
Mar 10, 2026
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.9.1
patch
Dependencies (46)
+ 38 more |
|
v2.9.0
minor
13 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-30852
GO-2026-4644
GHSA-m2w3-8f23-hxxf
Mar 10, 2026
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.9.0
minor
Dependencies (46)
+ 38 more |
|
v2.9.0-beta.3
pre
13 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-30852
GO-2026-4644
GHSA-m2w3-8f23-hxxf
Mar 10, 2026
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.9.0-beta.3
pre
Dependencies (46)
+ 38 more |
|
v2.9.0-beta.2
pre
13 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-30852
GO-2026-4644
GHSA-m2w3-8f23-hxxf
Mar 10, 2026
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.9.0-beta.2
pre
Dependencies (45)
+ 37 more |
|
v2.9.0-beta.1
pre
13 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-30852
GO-2026-4644
GHSA-m2w3-8f23-hxxf
Mar 10, 2026
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.9.0-beta.1
pre
Dependencies (45)
+ 37 more |
|
v2.8.4
patch
13 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-30852
GO-2026-4644
GHSA-m2w3-8f23-hxxf
Mar 10, 2026
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.8.4
patch
Dependencies (45)
+ 37 more |
|
v2.8.2
patch
13 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-30852
GO-2026-4644
GHSA-m2w3-8f23-hxxf
Mar 10, 2026
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.8.2
patch
Dependencies (45)
+ 37 more |
|
v2.8.1
patch
13 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-30852
GO-2026-4644
GHSA-m2w3-8f23-hxxf
Mar 10, 2026
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.8.1
patch
Dependencies (45)
+ 37 more |
|
v2.8.0
minor
13 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-30852
GO-2026-4644
GHSA-m2w3-8f23-hxxf
Mar 10, 2026
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.8.0
minor
Dependencies (45)
+ 37 more |
|
v2.7.5
patch
13 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-30852
GO-2026-4644
GHSA-m2w3-8f23-hxxf
Mar 10, 2026
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy Fixed in
2.11.2
References Updated Mar 23, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.7.5
patch
Dependencies (41)
+ 33 more |
|
v2.7.1
patch
12 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.7.1
patch
Dependencies (41)
+ 33 more |
|
v2.7.0
minor
12 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45135
GO-2026-5492
GHSA-m675-2p33-xv9g
Jul 24, 2026
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy Fixed in
2.11.3
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.7.0
minor
Dependencies (41)
+ 33 more |
|
v2.7.0-beta.2
pre
11 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.7.0-beta.2
pre
Dependencies (40)
+ 32 more |
|
v2.6.4
patch
11 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.6.4
patch
Dependencies (36)
+ 28 more |
|
v2.6.1
minor
11 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.6.1
minor
Dependencies (35)
+ 27 more |
|
v2.6.0-beta.5
pre
11 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.6.0-beta.5
pre
Dependencies (35)
+ 27 more |
|
v2.6.0-beta.3
pre
11 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.6.0-beta.3
pre
Dependencies (35)
+ 27 more |
|
v2.6.0-beta.2
pre
11 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.6.0-beta.2
pre
Dependencies (35)
+ 27 more |
|
v2.6.0-beta.1
pre
11 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.6.0-beta.1
pre
Dependencies (35)
+ 27 more |
|
v2.5.2
patch
11 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.5.2
patch
Dependencies (33)
+ 25 more |
|
v2.5.1
patch
11 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.5.1
patch
Dependencies (33)
+ 25 more |
|
v2.5.0
minor
11 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev |
v2.5.0
minor
Dependencies (33)
+ 25 more |
|
v2.5.0-rc.1
pre
12 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2022-29718
GHSA-2927-hv3p-f3vp
Jun 03, 2022
Open redirect in caddy
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links. Fixed in
2.5.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
v2.5.0-rc.1
pre
Dependencies (33)
+ 25 more |
|
v2.4.6
patch
13 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2022-28923
GO-2023-1567
GHSA-qpm3-vr34-h8w8
Feb 16, 2023
Open redirect in github.com/caddyserver/caddy/v2 Due to improper request sanitization, a crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks. Fixed in
2.5.0-beta.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-29718
GHSA-2927-hv3p-f3vp
Jun 03, 2022
Open redirect in caddy
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links. Fixed in
2.5.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
v2.4.6
patch
Dependencies (28)
+ 20 more |
|
v2.4.4
patch
13 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2022-28923
GO-2023-1567
GHSA-qpm3-vr34-h8w8
Feb 16, 2023
Open redirect in github.com/caddyserver/caddy/v2 Due to improper request sanitization, a crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks. Fixed in
2.5.0-beta.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-29718
GHSA-2927-hv3p-f3vp
Jun 03, 2022
Open redirect in caddy
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links. Fixed in
2.5.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
v2.4.4
patch
Dependencies (28)
+ 20 more |
|
v2.4.3
patch
13 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2022-28923
GO-2023-1567
GHSA-qpm3-vr34-h8w8
Feb 16, 2023
Open redirect in github.com/caddyserver/caddy/v2 Due to improper request sanitization, a crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks. Fixed in
2.5.0-beta.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-29718
GHSA-2927-hv3p-f3vp
Jun 03, 2022
Open redirect in caddy
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links. Fixed in
2.5.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
v2.4.3
patch
Dependencies (28)
+ 20 more |
|
v2.4.2
patch
13 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2022-28923
GO-2023-1567
GHSA-qpm3-vr34-h8w8
Feb 16, 2023
Open redirect in github.com/caddyserver/caddy/v2 Due to improper request sanitization, a crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks. Fixed in
2.5.0-beta.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-29718
GHSA-2927-hv3p-f3vp
Jun 03, 2022
Open redirect in caddy
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links. Fixed in
2.5.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
v2.4.2
patch
Dependencies (28)
+ 20 more |
|
v2.4.1
minor
13 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-45692
GO-2026-5743
GHSA-x5w9-xh9r-mvfc
Jul 07, 2026
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2022-28923
GO-2023-1567
GHSA-qpm3-vr34-h8w8
Feb 16, 2023
Open redirect in github.com/caddyserver/caddy/v2 Due to improper request sanitization, a crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks. Fixed in
2.5.0-beta.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-29718
GHSA-2927-hv3p-f3vp
Jun 03, 2022
Open redirect in caddy
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links. Fixed in
2.5.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
v2.4.1
minor
Dependencies (28)
+ 20 more |
|
v2.3.0-rc.2
pre
12 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2022-28923
GO-2023-1567
GHSA-qpm3-vr34-h8w8
Feb 16, 2023
Open redirect in github.com/caddyserver/caddy/v2 Due to improper request sanitization, a crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks. Fixed in
2.5.0-beta.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-29718
GHSA-2927-hv3p-f3vp
Jun 03, 2022
Open redirect in caddy
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links. Fixed in
2.5.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
v2.3.0-rc.2
pre
Dependencies (27)
+ 19 more |
|
v2.3.0-beta.1
pre
12 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2022-28923
GO-2023-1567
GHSA-qpm3-vr34-h8w8
Feb 16, 2023
Open redirect in github.com/caddyserver/caddy/v2 Due to improper request sanitization, a crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks. Fixed in
2.5.0-beta.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-29718
GHSA-2927-hv3p-f3vp
Jun 03, 2022
Open redirect in caddy
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links. Fixed in
2.5.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
v2.3.0-beta.1
pre
Dependencies (27)
+ 19 more |
|
v2.3.0-1
pre
12 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2022-28923
GO-2023-1567
GHSA-qpm3-vr34-h8w8
Feb 16, 2023
Open redirect in github.com/caddyserver/caddy/v2 Due to improper request sanitization, a crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks. Fixed in
2.5.0-beta.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-29718
GHSA-2927-hv3p-f3vp
Jun 03, 2022
Open redirect in caddy
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links. Fixed in
2.5.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
v2.3.0-1
pre
Dependencies (27)
+ 19 more |
|
v2.2.2
minor
12 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2022-28923
GO-2023-1567
GHSA-qpm3-vr34-h8w8
Feb 16, 2023
Open redirect in github.com/caddyserver/caddy/v2 Due to improper request sanitization, a crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks. Fixed in
2.5.0-beta.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-29718
GHSA-2927-hv3p-f3vp
Jun 03, 2022
Open redirect in caddy
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links. Fixed in
2.5.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
v2.2.2
minor
Dependencies (27)
+ 19 more |
|
v2.2.3
patch
12 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2022-28923
GO-2023-1567
GHSA-qpm3-vr34-h8w8
Feb 16, 2023
Open redirect in github.com/caddyserver/caddy/v2 Due to improper request sanitization, a crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks. Fixed in
2.5.0-beta.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-29718
GHSA-2927-hv3p-f3vp
Jun 03, 2022
Open redirect in caddy
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links. Fixed in
2.5.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
v2.2.3
patch
Dependencies (27)
+ 19 more |
|
v2.2.0-rc.2
pre
12 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2022-28923
GO-2023-1567
GHSA-qpm3-vr34-h8w8
Feb 16, 2023
Open redirect in github.com/caddyserver/caddy/v2 Due to improper request sanitization, a crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks. Fixed in
2.5.0-beta.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-29718
GHSA-2927-hv3p-f3vp
Jun 03, 2022
Open redirect in caddy
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links. Fixed in
2.5.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
v2.2.0-rc.2
pre
Dependencies (27)
+ 19 more |
|
v2.2.0-rc.1
pre
12 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2022-28923
GO-2023-1567
GHSA-qpm3-vr34-h8w8
Feb 16, 2023
Open redirect in github.com/caddyserver/caddy/v2 Due to improper request sanitization, a crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks. Fixed in
2.5.0-beta.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-29718
GHSA-2927-hv3p-f3vp
Jun 03, 2022
Open redirect in caddy
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links. Fixed in
2.5.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
v2.2.0-rc.1
pre
Dependencies (26)
+ 18 more |
|
v2.1.1
patch
12 CVEs
GO-2026-5408
GHSA-gx7w-56w6-g48x
Jul 24, 2026
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy Fixed in
2.11.3
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52846
GO-2026-5660
GHSA-vcc4-2c75-vc9v
Jul 24, 2026
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Caddy: stripHTML template function bypass in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52844
GO-2026-5595
GHSA-qrp7-cvwr-j2c6
Jul 24, 2026
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy Fixed in
2.11.4
Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-52845
GO-2026-5346
GHSA-f59h-q822-g45g
Jul 24, 2026
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy Fixed in
2.11.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-27589
GO-2026-4537
GHSA-879p-475x-rqh2
Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27588
GO-2026-4541
GHSA-x76f-jf84-rqj8
Feb 26, 2026
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27586
GO-2026-4539
GHSA-hffm-g8v7-wrv7
Feb 26, 2026
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27587
GO-2026-4538
GHSA-g7pc-pc7g-h8jh
Feb 26, 2026
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27585
GO-2026-4535
GHSA-4xrr-hq4w-6vf4
Feb 26, 2026
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References
Updated Feb 26, 2026 · Source: OSV.dev
CVE-2026-27590
GO-2026-4536
GHSA-5r3v-vc8m-m96g
Feb 26, 2026
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Fixed in
2.11.1
References Updated Feb 26, 2026 · Source: OSV.dev
CVE-2022-28923
GO-2023-1567
GHSA-qpm3-vr34-h8w8
Feb 16, 2023
Open redirect in github.com/caddyserver/caddy/v2 Due to improper request sanitization, a crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks. Fixed in
2.5.0-beta.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-29718
GHSA-2927-hv3p-f3vp
Jun 03, 2022
Open redirect in caddy
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links. Fixed in
2.5.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
v2.1.1
patch
Dependencies (27)
+ 19 more |