caddyserver caddy vulnerabilities
17 published CVEs name caddyserver caddy among the affected products.
- 17Published CVEs17 of them scored
- 17Last 12 monthspublished in the last year
- 0Critical8 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-55458
Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
caddyserver · caddy
Low2.9 - CVE-2026-92700
Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation
caddyserver · caddy
Medium6.3 - CVE-2026-92284
Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS
caddyserver · caddy
Medium6.9 - CVE-2026-77281
Caddy: rewrite placeholder re-expansion
caddyserver · caddy
Medium6.5 - CVE-2026-45135
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
caddyserver · caddy
High8.1 - CVE-2026-45692
Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
caddyserver · caddy
Medium5.4 - CVE-2026-52845
Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
caddyserver · caddy
High8.1 - CVE-2026-52844
Caddy: Windows `file_server` path authorization bypass via encoded backslash
caddyserver · caddy
High7.5 - CVE-2026-52846
Caddy: stripHTML template function bypass
caddyserver · caddy
Medium4.2 - CVE-2026-30851
Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation
caddyserver · caddy
High8.1