Caddyserver Caddy
20 CVEs affecting Caddyserver Caddy. Latest disclosed: 2026-06-23. Critical: 5, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-27590 | Critical | 9.8 | 2026-02-24 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lo… |
CVE-2018-21246 | Critical | 9.8 | 2020-06-15 | Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode. |
CVE-2026-27588 | Critical | 9.1 | 2026-02-24 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request matcher is documented as case-insensitive… |
CVE-2026-27587 | Critical | 9.1 | 2026-02-24 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request matcher is intended to be case-insensitiv… |
CVE-2026-27586 | Critical | 9.1 | 2026-02-24 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `ClientAuthentication.provision()` cause mTLS… |
CVE-2026-52845 | High | 8.1 | 2026-06-23 | Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header b… |
CVE-2026-45135 | High | 8.1 | 2026-06-23 | Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/… |
CVE-2026-30851 | High | 8.1 | 2026-03-07 | Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-… |
CVE-2026-52844 | High | 7.5 | 2026-06-23 | Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private… |
CVE-2026-30852 | High | 7.5 | 2026-03-07 | Caddy is an extensible server platform that uses TLS by default. From version 2.7.5 to before version 2.11.2, the vars_regexp matcher in vars.go:337 double-exp… |
CVE-2023-44487 | High | 7.5 | 2023-10-10 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
CVE-2022-34037 | High | 7.5 | 2022-07-22 | An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via… |
CVE-2026-27589 | Medium | 6.5 | 2026-02-24 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (default listen `127.0.0.1:2019`) exposes a… |
CVE-2026-27585 | Medium | 6.5 | 2026-02-24 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backsl… |
CVE-2023-50463 | Medium | 6.5 | 2023-12-10 | The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof their source IP address… |
CVE-2022-28923 | Medium | 6.1 | 2023-02-06 | Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs. |
CVE-2022-29718 | Medium | 6.1 | 2022-06-02 | Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbi… |
CVE-2026-45692 | Medium | 5.4 | 2026-06-23 | Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree… |
CVE-2026-52846 | Medium | 4.2 | 2026-06-23 | Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from… |
CVE-2018-19148 | Low | 3.7 | 2018-11-10 | Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames. Specifically, when unabl… |