Skip to content

Vendor

caddyserver vulnerabilities

26 published CVES affecting caddyserver, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
26
Critical
1
High
9
Medium
13
Low
3
Unscored
0
CISA KEV
1
Atom feed of caddyserver alerts

Products

Latest caddyserver CVEs

Newest publication first · page 1 of 2

  5. CVE-2026-77281 Caddy: rewrite placeholder re-expansion

    Published
    MediumCVSS 6.5 EPSS 0.49%

    Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite() can pass attacker-controlled replacement b...

  10. CVE-2026-52846 Caddy: stripHTML template function bypass

    Published
    MediumCVSS 4.2 EPSS 0.25%

    Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potent...

  12. GHSA-wwhq-w58m-w29c Caddy CVE-2026-30852 Fix Bypass

    Published
    MediumCVSS 5.5

    TL;DR CVE-2026-30852 fixed double expansion in vars_regexp when the variable key is a placeholder (e.g. {http.vars.x}). The fix does NOT protect literal key names (e.g. tenant_id). An attacker injects {env.AWS_SECRET_ACCESS_KEY} or {file./etc/passwd} via a request header → Caddy...

  21. CVE-2023-50463 Header spoofing in caddy-geo-ip

    Published
    MediumCVSS 6.5 EPSS 0.66%

    The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism (trusted_proxy directive in reverse_proxy or IP a...

  22. CVE-2023-44487 HTTP/2 Stream Cancellation Attack

    Published
    HighCVSS 7.5 EPSS 100.0% CISA KEV added 2023-10-10 Exploited in the wild Public exploit PoC

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

  23. CVE-2022-28923 Open Redirect in Caddy

    Published
    MediumCVSS 6.1 EPSS 1.4%

    Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs.

  24. CVE-2022-29718 Open redirect in caddy

    Published
    MediumCVSS 6.1 EPSS 1.1%

    Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.