Skip to content
OpenAdvisories

Package · Go

github.com/caddyserver/caddy

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.1
    CVE-2026-52845

    Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

    Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_f…

    caddyserver caddy github.com/caddyserver/caddy/v2 caddy Debian Ubuntu Go
  • High 7.5
    CVE-2026-52844

    Caddy: Windows `file_server` path authorization bypass via encoded backslash

    Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthent…

    caddyserver caddy github.com/caddyserver/caddy/v2 caddy Ubuntu Go