# github.com/caddyserver/caddy/v2 (Go) vulnerabilities 19 known vulnerabilities (8 high, 9 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v2.11.9 (Nov 4, 2026): no advisory affects it - Newest unaffected release: v2.11.9 (Nov 4, 2026), the latest release - Releases: 107 since v2.0.0 (May 2, 2020) - Registry: https://pkg.go.dev/github.com/caddyserver/caddy/v2 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-55458: v2.0.0-beta.13 to v2.11.4 (v2.11.5 is outside it) - CVE-2026-92700: v2.0.0-beta.13 to v2.11.3 (v2.11.4 is outside it) - CVE-2026-92284: v2.0.0-beta.13 to v2.11.3 (v2.11.4 is outside it) - CVE-2026-77281: v2.0.0-beta.13 to v2.11.3 (v2.11.4 is outside it) - CVE-2026-45135: v2.7.0 to v2.11.2 (v2.11.3 is outside it) - CVE-2026-45692: v2.4.0 to v2.11.2 (v2.11.3 is outside it) - CVE-2026-52845: v2.0.0-beta.13 to v2.11.3 (v2.11.4 is outside it) - CVE-2026-52844: v2.0.0-beta.13 to v2.11.3 (v2.11.4 is outside it) - CVE-2026-52846: v2.0.0-beta.13 to v2.11.3 (v2.11.4 is outside it) - CVE-2026-30851: v2.10.0 to v2.11.1 (v2.11.2 is outside it) - CVE-2026-30852: v2.7.5 to v2.11.1 (v2.11.2 is outside it) - CVE-2026-27590: v2.0.0-beta.13 to v2.11.0 (v2.11.1 is outside it) - CVE-2026-27589: v2.0.0-beta.13 to v2.11.0 (v2.11.1 is outside it) - CVE-2026-27588: v2.0.0-beta.13 to v2.11.0 (v2.11.1 is outside it) - CVE-2026-27587: v2.0.0-beta.13 to v2.11.0 (v2.11.1 is outside it) - CVE-2026-27586: v2.0.0-beta.13 to v2.11.0 (v2.11.1 is outside it) - CVE-2026-27585: v2.0.0-beta.13 to v2.11.0 (v2.11.1 is outside it) - CVE-2022-28923: v2.0.0-beta.13 to v2.4.6 (v2.5.0-beta.1 is outside it) - CVE-2022-29718: v2.0.0-beta.13 to v2.5.0-rc.1 (v2.5.0 is outside it) ## Advisories (19) ### [CVE-2026-55458](https://cve.now/CVE-2026-55458): Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through - Severity: Low 2.9 - Published: Nov 5, 2026 - Affected: fixed in 2.11.5. - Fixed in v2.11.5 (released Sep 30, 2026, 36 days before disclosure). - The latest release, v2.11.9, is not affected. ### [CVE-2026-92700](https://cve.now/CVE-2026-92700): Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation - Severity: Medium 6.3 - Published: Sep 23, 2026 - Affected: fixed in 2.11.4. - Fixed in v2.11.4 (released Jun 1, 2026, 114 days before disclosure). - The latest release, v2.11.9, is not affected. ### [CVE-2026-92284](https://cve.now/CVE-2026-92284): Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS - Severity: Medium 6.9 - Published: Sep 23, 2026 - Affected: fixed in 2.11.4. - Fixed in v2.11.4 (released Jun 1, 2026, 114 days before disclosure). - The latest release, v2.11.9, is not affected. ### [CVE-2026-77281](https://cve.now/CVE-2026-77281): Caddy: rewrite placeholder re-expansion - Severity: Medium 6.5 - Published: Sep 17, 2026 - Affected: fixed in 2.11.4. - Fixed in v2.11.4 (released Jun 1, 2026, 108 days before disclosure). - The latest release, v2.11.9, is not affected. ### [CVE-2026-45135](https://cve.now/CVE-2026-45135): Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files - Severity: High 8.1 - Published: Jun 23, 2026 - Affected: from 2.7.0, fixed in 2.11.3. - Fixed in v2.11.3 (released May 11, 2026, 43 days before disclosure). - The latest release, v2.11.9, is not affected. ### [CVE-2026-45692](https://cve.now/CVE-2026-45692): Caddy: Remote Admin Authorization Bypass in \`/config\` API via Array Index Normalization - Severity: Medium 5.4 - Published: Jun 23, 2026 - Affected: from 2.4.0, fixed in 2.11.3. - Fixed in v2.11.3 (released May 11, 2026, 43 days before disclosure). - The latest release, v2.11.9, is not affected. ### [CVE-2026-52845](https://cve.now/CVE-2026-52845): Caddy: FastCGI header normalization bypass in \`forward\_auth copy\_headers\` - Severity: High 8.1 - Published: Jun 23, 2026 - Affected: fixed in 2.11.4. - Fixed in v2.11.4 (released Jun 1, 2026, 22 days before disclosure). - The latest release, v2.11.9, is not affected. ### [CVE-2026-52844](https://cve.now/CVE-2026-52844): Caddy: Windows \`file\_server\` path authorization bypass via encoded backslash - Severity: High 7.5 - Published: Jun 23, 2026 - Affected: fixed in 2.11.4. - Fixed in v2.11.4 (released Jun 1, 2026, 22 days before disclosure). - The latest release, v2.11.9, is not affected. ### [CVE-2026-52846](https://cve.now/CVE-2026-52846): Caddy: stripHTML template function bypass - Severity: Medium 4.2 - Published: Jun 23, 2026 - Affected: fixed in 2.11.4. - Fixed in v2.11.4 (released Jun 1, 2026, 22 days before disclosure). - The latest release, v2.11.9, is not affected. ### [CVE-2026-30851](https://cve.now/CVE-2026-30851): Caddy forward\_auth copy\_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation - Severity: High 8.1 - Published: Mar 7, 2026 - Affected: from 2.10.0, fixed in 2.11.2. - Fixed in v2.11.2 (released Mar 5, 2026, 2 days before disclosure). - The latest release, v2.11.9, is not affected. ### [CVE-2026-30852](https://cve.now/CVE-2026-30852): Caddy: vars\_regexp double-expands user input, leaking env vars and files - Severity: Medium 5.5 - Published: Mar 7, 2026 - Affected: from 2.7.5, fixed in 2.11.2. - Fixed in v2.11.2 (released Mar 5, 2026, 2 days before disclosure). - The latest release, v2.11.9, is not affected. ### [CVE-2026-27590](https://cve.now/CVE-2026-27590): Caddy: Unicode case-folding length expansion causes incorrect split\_path index (SCRIPT\_NAME/PATH\_INFO confusion) in FastCGI transport - Severity: High 8.9 - Published: Feb 24, 2026 - Affected: fixed in 2.11.1. - Fixed in v2.11.1 (released Feb 20, 2026, 4 days before disclosure). - The latest release, v2.11.9, is not affected. ### [CVE-2026-27589](https://cve.now/CVE-2026-27589): Caddy vulnerable to cross-origin config application via local admin API /load (caddy) - Severity: Medium 6.9 - Published: Feb 24, 2026 - Affected: fixed in 2.11.1. - Fixed in v2.11.1 (released Feb 20, 2026, 4 days before disclosure). - The latest release, v2.11.9, is not affected. ### [CVE-2026-27588](https://cve.now/CVE-2026-27588): Caddy: MatchHost becomes case-sensitive for large host lists (\>100), enabling host-based route/auth bypass - Severity: High 7.7 - Published: Feb 24, 2026 - Affected: fixed in 2.11.1. - Fixed in v2.11.1 (released Feb 20, 2026, 4 days before disclosure). - The latest release, v2.11.9, is not affected. ### [CVE-2026-27587](https://cve.now/CVE-2026-27587): Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass - Severity: High 7.7 - Published: Feb 24, 2026 - Affected: fixed in 2.11.1. - Fixed in v2.11.1 (released Feb 20, 2026, 4 days before disclosure). - The latest release, v2.11.9, is not affected. ### [CVE-2026-27586](https://cve.now/CVE-2026-27586): Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed - Severity: High 8.8 - Published: Feb 24, 2026 - Affected: fixed in 2.11.1. - Fixed in v2.11.1 (released Feb 20, 2026, 4 days before disclosure). - The latest release, v2.11.9, is not affected. ### [CVE-2026-27585](https://cve.now/CVE-2026-27585): Caddy's improper sanitization of glob characters in file matcher may lead to bypassing security protections - Severity: Medium 6.9 - Published: Feb 24, 2026 - Affected: fixed in 2.11.1. - Fixed in v2.11.1 (released Feb 20, 2026, 4 days before disclosure). - The latest release, v2.11.9, is not affected. ### [CVE-2022-28923](https://cve.now/CVE-2022-28923): Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via… - Severity: Medium 6.1 - Published: Feb 6, 2023 - Affected: fixed in 2.5.0-beta.1. - Fixed in v2.5.0-beta.1 (released Mar 9, 2022, 334 days before disclosure). - The latest release, v2.11.9, is not affected. ### [CVE-2022-29718](https://cve.now/CVE-2022-29718): Caddy v2.4 was discovered to contain an open redirect vulnerability. - Severity: Unrated - Published: Jun 2, 2022 - Affected: fixed in 2.5.0. - Fixed in v2.5.0 (released Apr 25, 2022, 38 days before disclosure). - The latest release, v2.11.9, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/caddyserver/caddy/v2 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.