What’s Vulnerable › Products

caddyserver caddy vulnerabilities

23 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 16 published in the last 12 months.

Check whether your caddyserver caddy version is affected

Exploited caddyserver caddy vulnerabilities

• CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability

Latest caddyserver caddy vulnerabilities

• CVE-2026-92700 — Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation (CVSS 6.3)
• CVE-2026-92284 — Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS (CVSS 6.9)
• CVE-2026-77281 — Caddy: rewrite placeholder re-expansion (CVSS 6.5)
• CVE-2026-52846 — Caddy: stripHTML template function bypass (CVSS 4.2)
• CVE-2026-52845 — Caddy: FastCGI header normalization bypass in `forward_auth copy_headers` (CVSS 8.1)
• CVE-2026-52844 — Caddy: Windows `file_server` path authorization bypass via encoded backslash (CVSS 7.5)
• CVE-2026-45692 — Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization (CVSS 3.8)
• CVE-2026-45135 — Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files (CVSS 8.1)
• CVE-2026-30852 — Caddy: vars_regexp double-expands user input, leaking env vars and files (CVSS 7.5)
• CVE-2026-30851 — Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation (CVSS 8.8)
• CVE-2026-27590 — Caddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport (CVSS 9.8)
• CVE-2026-27589 — Caddy vulnerable to cross-origin config application via local admin API /load (caddy) (CVSS 6.5)
• CVE-2026-27588 — Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass (CVSS 9.1)
• CVE-2026-27587 — Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass (CVSS 9.1)
• CVE-2026-27586 — Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed (CVSS 9.1)
• CVE-2026-27585 — Caddy's improper sanitization of glob characters in file matcher may lead to bypassing security protections (CVSS 6.5)
• CVE-2023-50463 — (CVSS 6.5)
• CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability (CVSS 7.5) — exploited
• CVE-2022-28923 — (CVSS 6.1)
• CVE-2022-34037 — (CVSS 7.5)
• CVE-2022-29718 — (CVSS 6.1)
• CVE-2018-21246 — (CVSS 9.8)
• CVE-2018-19148 — (CVSS 3.7)