GO-2026-5013 vulnerabilities

Vulnerabilities for packages: chisel, loki, nfpm, terraform-provider-acme, kine, containerd, crossplane-provider-aws-lambda, wal-g, caddy, crossplane-provider-family-azure, crossplane-provider-aws-ec2, kubescape, crossplane-provider-aws-memorydb, terraform-provider-tls, istio, kargo, zot, flux,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: nri-consul, conftest, emissary, nri-redis, helm-operator, containerd, helm-set-status, wait-for-port, wal-g, ini-file, caddy, controller-gen, nri-apache, kubernetes-dashboard-api, docker-machine-driver-harvester, harbor-cli, lazydocker, cloud-sql-proxy,...

[SECURITY] [DSA 6429-1] caddy security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6429-1 [email protected] https://www.debian.org/security/ Aron Xu August 11, 2026 https://www.debian.org/security/faq -...

Debian dsa-6429 : caddy - security update

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6429 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6429-1 [email protected] https://www.debian.org/securit...

SUSE CVE-2026-45692

Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different...

SUSE CVE-2026-46415

The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Defender used r.RemoteAddr when evaluating whether a request should be blocked. RemoteAddr is the address of the immediate peer...

GO-2026-5492 Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy...

GO-2026-5730 Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy

Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: caddy: caddy-2.11.4-0.3.hum1 aarch64, x8664 caddy-2.11.4-0.3.hum1.src src Security Fixes: caddy: CVE-2026-56852...

CVE-2026-46415

The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Defender used r.RemoteAddr when evaluating whether a request should be blocked. RemoteAddr is the address of the immediate peer...

CVE-2026-46415 Caddy Defender trusted proxy client IP bypass

The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Defender used r.RemoteAddr when evaluating whether a request should be blocked. RemoteAddr is the address of the immediate peer...

CVE-2026-46415 Caddy Defender trusted proxy client IP bypass

The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Defender used r.RemoteAddr when evaluating whether a request should be blocked. RemoteAddr is the address of the immediate peer...

CVE-2026-46415

The CVE-2026-46415 issue affects the Caddy Defender plugin for Caddy, prior to version 0.10.1. Defender evaluated blocking decisions using r.RemoteAddr (the immediate peer), which could be a trusted proxy in deployments behind proxies/CDNs/load balancers, allowing clients from blocked IP ranges t...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: caddy: caddy-2.11.4-0.2.hum1 aarch64, x8664 caddy-2.11.4-0.2.hum1.src src...

[SECURITY] Fedora 43 Update: caddy-2.10.2-9.fc43

Caddy is an extensible server platform that uses TLS by default...

[SECURITY] Fedora 44 Update: caddy-2.10.2-9.fc44

Caddy is an extensible server platform that uses TLS by default...

Fedora 43 : caddy (2026-3dc324bd9a)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3dc324bd9a advisory. Security update resolving 22 CVEs across both caddy itself and its vendored libraries. Tenable has extracted the preceding description block directl...

Fedora 44 : caddy (2026-950cac64f2)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-950cac64f2 advisory. Security update resolving 17 CVEs across both caddy itself and its vendored libraries. Tenable has extracted the preceding description block directl...

BIT-APPSMITH-2026-55454 Appsmith: Caddy admin API exposed without authentication

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authentication by default — is bound on 0.0.0.0:2019 inside the container. While this listener is not directly published to the host by...

CVE-2026-52845

A flaw was found in Caddy, an extensible server platform. A remote attacker can exploit a vulnerability in the forwardauth copyheaders functionality. This occurs because Caddy normalizes HTTP headers into Common Gateway Interface CGI variables by replacing hyphens with underscores, allowing a...