GoPackage

github.com/caddyserver/caddy

6 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: v1.0.5 (Jan 15, 2020): affected by 4 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 6 · 2 high, 1 medium

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-52845High 8.1
Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
Affected: through 1.0.5.
No fix released. The latest release, v1.0.5, is still affected.
CVE-2026-52844High 7.5
Caddy: Windows `file_server` path authorization bypass via encoded backslash
Affected: through 1.0.5.
No fix released. The latest release, v1.0.5, is still affected.
CVE-2026-52846Medium 4.2
Caddy: stripHTML template function bypass
Affected: through 1.0.5.
No fix released. The latest release, v1.0.5, is still affected.
CVE-2022-29718Unrated
Caddy v2.4 was discovered to contain an open redirect vulnerability.
Affected: fixed in 2.5.0.
No fix released. The advisory names 2.5.0 as the fix, which the registry doesn't have yet. The latest release, v1.0.5, is still affected.
CVE-2018-21246Unrated
Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the…
Affected: fixed in 0.10.13.
Fixed in v0.10.13 (released Apr 18, 2018, 789 days before disclosure).
The latest release, v1.0.5, is not affected.
CVE-2018-19148Unrated
Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames.
Affected: fixed in 0.11.1.
Fixed in v0.11.1 (released Nov 12, 2018, 2 days after disclosure).
The latest release, v1.0.5, is not affected.