caddy

a project Every site on HTTPS Caddy is an extensible server platform that uses TLS by default. Releases · Documentation · Get Help Powered by Special thanks to: Warp, built for coding with multiple AI agents Available for MacOS, Linux, & Windows Menu Features Install Build from source For...

QUIC-attacks

QUIC-attacks CVE-2022-30591 The current repository serves the purpose of sharing the scripts we used for educational usage. These attacks were a part of our study check here, and were tested against 6 different QUIC-enabled servers IIS, NGINX, LiteSpeed, Cloudflare, H2O, and Caddy. The quic-loris...

bbscope

bbscope.com Web interface and API for aggregating bug bounty program scopes from HackerOne, Bugcrowd, Intigriti, and YesWeHack. Quick start Docker cd website cp .env.example .env Edit .env — at minimum set POSTGRESPASSWORD and your platform credentials docker compose up -d --build The site will b...

RedCaddy

RedCaddy C2 redirector base on caddy Table of content Overview Feature Note Quick start Step by step References Overview Generate caddyfile with c2 malleable profiles Feature Block IP by GEOIP country Allow requests by header matcher User-agent & IP blacklist Support multiple redirection TeamServ...

Caddy 2.4.6 - Open Redirect

Caddy 2.4.6 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site via a crafted URL and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-28923 info: name: Caddy 2.4.6 - Open Redirect author: Sascha...

CaddySmith

CaddySmith CaddySmith is a small Python script that reads a Cobalt Strike or Sliver C2 profile and forges a Caddy web server config out of it. The generated Caddyfile turns a regular Linux box into a redirector: legitimate beacon traffic gets reverse-proxied to your team server, and anything else...

CVE-2026-55458

A flaw was found in Caddy's reverse proxy module. When processing protocol upgrade responses, the proxy fails to properly remove hop-by-hop headers intended only for intermediate connections. A malicious or compromised upstream server can exploit this flaw to forward restricted connection headers...

CVE-2026-55458

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.5, the reverse proxy's finalizeResponse method in modules/caddyhttp/reverseproxy/reverseproxy.go handles an upstream 101 Switching Protocols response before running removeConnectionHeaders and the hopHeaders deletion...

UBUNTU-CVE-2026-55458

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.5, the reverse proxy's finalizeResponse method in modules/caddyhttp/reverseproxy/reverseproxy.go handles an upstream 101 Switching Protocols response before running removeConnectionHeaders and the hopHeaders deletion...

Linux Distros Unpatched Vulnerability : CVE-2026-55458

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.5, the reverse proxy's finalizeResponse method in...

CVE-2026-55458

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.5, the reverse proxy's finalizeResponse method in modules/caddyhttp/reverseproxy/reverseproxy.go handles an upstream 101 Switching Protocols response before running removeConnectionHeaders and the hopHeaders deletion...

DEBIAN-CVE-2026-55458

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.5, the reverse proxy's finalizeResponse method in modules/caddyhttp/reverseproxy/reverseproxy.go handles an upstream 101 Switching Protocols response before running removeConnectionHeaders and the hopHeaders deletion...

CVE-2026-55458 Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.5, the reverse proxy's finalizeResponse method in modules/caddyhttp/reverseproxy/reverseproxy.go handles an upstream 101 Switching Protocols response before running removeConnectionHeaders and the hopHeaders deletion...

CVE-2026-55458

Caddy 's reverse proxy fails to strip RFC 7230 hop-by-hop headers from upstream responses when handling WebSocket upgrades (HTTP 101 Switching Protocols). Specifically, the finalizeResponse method in modules/caddyhttp/reverseproxy/reverseproxy.go returns early for 101 status codes, bypassing the ...

EUVD-2026-117782

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.5, the reverse proxy's finalizeResponse method in modules/caddyhttp/reverseproxy/reverseproxy.go handles an upstream 101 Switching Protocols response before running removeConnectionHeaders and the hopHeaders deletion...

CVE-2026-55458 Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.5, the reverse proxy's finalizeResponse method in modules/caddyhttp/reverseproxy/reverseproxy.go handles an upstream 101 Switching Protocols response before running removeConnectionHeaders and the hopHeaders deletion...

CVE-2026-55458

Caddy's reverse proxy fails to strip RFC 7230 hop-by-hop headers from upstream responses when handling WebSocket upgrades HTTP 101 Switching Protocols. Headers including "Alt-Svc", "Keep-Alive", "Proxy-Authenticate", "Transfer-Encoding", or "Trailer", which Caddy actually correctly strips for...

CVE-2026-54162

Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the fitCellLeft render helper without neutralizing terminal escape or control sequences. An...

Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through

AI Disclosure This vulnerability was discovered via deepseek-v4-pro1m for finding potential vulnerabilities / inconsistencies in the code base. I made the AI check if Caddy is compliant with various RFCs, incl. 7230. I also used it to help write the PoC, since it was honestly much faster than...

GHSA-8QX7-J2V2-X6Q5 Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through

AI Disclosure This vulnerability was discovered via deepseek-v4-pro1m for finding potential vulnerabilities / inconsistencies in the code base. I made the AI check if Caddy is compliant with various RFCs, incl. 7230. I also used it to help write the PoC, since it was honestly much faster than...