Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/caddyserver/caddy/v2

19 known vulnerabilities (8 high, 9 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
v2.11.9 (Nov 4, 2026): no advisory affects it
Newest unaffected release
v2.11.9 (Nov 4, 2026), the latest release
Advisories
19 · 8 high, 9 medium, 1 low
Releases
107 since v2.0.0 (May 2, 2020)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 19 advisoriesShow fewer advisories
  • CVE-2026-27589
    Affects v2.0.0-beta.13 to v2.11.0 (v2.11.1 is outside it)
  • CVE-2026-27588
    Affects v2.0.0-beta.13 to v2.11.0 (v2.11.1 is outside it)
  • CVE-2026-27587
    Affects v2.0.0-beta.13 to v2.11.0 (v2.11.1 is outside it)
  • CVE-2026-27586
    Affects v2.0.0-beta.13 to v2.11.0 (v2.11.1 is outside it)
  • CVE-2026-27585
    Affects v2.0.0-beta.13 to v2.11.0 (v2.11.1 is outside it)
  • CVE-2022-28923
    Affects v2.0.0-beta.13 to v2.4.6 (v2.5.0-beta.1 is outside it)
  • CVE-2022-29718
    Affects v2.0.0-beta.13 to v2.5.0-rc.1 (v2.5.0 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 19

  • Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through

    Affected: fixed in 2.11.5.

    Fixed in v2.11.5 (released Sep 30, 2026, 36 days before disclosure).

    The latest release, v2.11.9, is not affected.

  • CVE-2026-92700Medium 6.3

    Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation

    Affected: fixed in 2.11.4.

    Fixed in v2.11.4 (released Jun 1, 2026, 114 days before disclosure).

    The latest release, v2.11.9, is not affected.

  • CVE-2026-92284Medium 6.9

    Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS

    Affected: fixed in 2.11.4.

    Fixed in v2.11.4 (released Jun 1, 2026, 114 days before disclosure).

    The latest release, v2.11.9, is not affected.

  • CVE-2026-77281Medium 6.5

    Caddy: rewrite placeholder re-expansion

    Affected: fixed in 2.11.4.

    Fixed in v2.11.4 (released Jun 1, 2026, 108 days before disclosure).

    The latest release, v2.11.9, is not affected.

  • Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

    Affected: from 2.7.0, fixed in 2.11.3.

    Fixed in v2.11.3 (released May 11, 2026, 43 days before disclosure).

    The latest release, v2.11.9, is not affected.

  • CVE-2026-45692Medium 5.4

    Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization

    Affected: from 2.4.0, fixed in 2.11.3.

    Fixed in v2.11.3 (released May 11, 2026, 43 days before disclosure).

    The latest release, v2.11.9, is not affected.

  • Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

    Affected: fixed in 2.11.4.

    Fixed in v2.11.4 (released Jun 1, 2026, 22 days before disclosure).

    The latest release, v2.11.9, is not affected.

  • Caddy: Windows `file_server` path authorization bypass via encoded backslash

    Affected: fixed in 2.11.4.

    Fixed in v2.11.4 (released Jun 1, 2026, 22 days before disclosure).

    The latest release, v2.11.9, is not affected.

  • CVE-2026-52846Medium 4.2

    Caddy: stripHTML template function bypass

    Affected: fixed in 2.11.4.

    Fixed in v2.11.4 (released Jun 1, 2026, 22 days before disclosure).

    The latest release, v2.11.9, is not affected.

  • Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation

    Affected: from 2.10.0, fixed in 2.11.2.

    Fixed in v2.11.2 (released Mar 5, 2026, 2 days before disclosure).

    The latest release, v2.11.9, is not affected.

  • CVE-2026-30852Medium 5.5

    Caddy: vars_regexp double-expands user input, leaking env vars and files

    Affected: from 2.7.5, fixed in 2.11.2.

    Fixed in v2.11.2 (released Mar 5, 2026, 2 days before disclosure).

    The latest release, v2.11.9, is not affected.

  • Caddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport

    Affected: fixed in 2.11.1.

    Fixed in v2.11.1 (released Feb 20, 2026, 4 days before disclosure).

    The latest release, v2.11.9, is not affected.

  • CVE-2026-27589Medium 6.9

    Caddy vulnerable to cross-origin config application via local admin API /load (caddy)

    Affected: fixed in 2.11.1.

    Fixed in v2.11.1 (released Feb 20, 2026, 4 days before disclosure).

    The latest release, v2.11.9, is not affected.

  • Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass

    Affected: fixed in 2.11.1.

    Fixed in v2.11.1 (released Feb 20, 2026, 4 days before disclosure).

    The latest release, v2.11.9, is not affected.

  • Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass

    Affected: fixed in 2.11.1.

    Fixed in v2.11.1 (released Feb 20, 2026, 4 days before disclosure).

    The latest release, v2.11.9, is not affected.

Show all 19 advisoriesShow fewer advisories

  • Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed

    Affected: fixed in 2.11.1.

    Fixed in v2.11.1 (released Feb 20, 2026, 4 days before disclosure).

    The latest release, v2.11.9, is not affected.

  • CVE-2026-27585Medium 6.9

    Caddy's improper sanitization of glob characters in file matcher may lead to bypassing security protections

    Affected: fixed in 2.11.1.

    Fixed in v2.11.1 (released Feb 20, 2026, 4 days before disclosure).

    The latest release, v2.11.9, is not affected.

  • CVE-2022-28923Medium 6.1

    Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via…

    Affected: fixed in 2.5.0-beta.1.

    Fixed in v2.5.0-beta.1 (released Mar 9, 2022, 334 days before disclosure).

    The latest release, v2.11.9, is not affected.

  • Caddy v2.4 was discovered to contain an open redirect vulnerability.

    Affected: fixed in 2.5.0.

    Fixed in v2.5.0 (released Apr 25, 2022, 38 days before disclosure).

    The latest release, v2.11.9, is not affected.