Skip to content
OpenAdvisories

Package · Go

github.com/caddyserver/caddy/v2/modules/caddyhttp

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.5
    CVE-2026-30852

    Caddy: vars_regexp double-expands user input, leaking env vars and files

    Caddy is an extensible server platform that uses TLS by default. From version 2.7.5 to before version 2.11.2, the vars_regexp matcher in vars.go:337 double-expands user-controlled input through the Caddy replacer. When vars_regexp matches against a placeholde…

    caddyserver caddy github.com/caddyserver/caddy/v2 caddy Ubuntu Alpine Go