Caddy 安全漏洞

Caddy is an open-source, cross-platform HTTP/Web server developed by the Caddy company. Versions of Caddy prior to 2.11.1 contained security vulnerabilities. These vulnerabilities stemmed from the HTTP host request matcher becoming case-sensitive when configuring large host lists, which could all...

PT-2026-21774

Name of the Vulnerable Software and Affected Versions Caddy versions prior to 2.11.1 Description The local Caddy admin API, listening by default on 127.0.0.1:2019, includes a POST /load endpoint that allows replacing the entire running configuration. When origin enforcement is not enabled enforce...

PT-2026-21773

Name of the Vulnerable Software and Affected Versions Caddy versions prior to 2.11.1 Description Caddy’s HTTP host request matcher is documented as case-insensitive, but becomes case-sensitive when configured with a large host list more than 100 entries due to an optimized matching path. An...

PT-2026-21767

Name of the Vulnerable Software and Affected Versions Caddy versions prior to 2.11.1 Description The path sanitization routine in Caddy's file matcher does not properly sanitize backslashes, potentially allowing bypass of path-related security protections. This issue affects users with specific...

[SECURITY] Fedora 42 Update: caddy-2.10.0-1.fc42

Caddy is an extensible server platform that uses TLS by default...

Caddy Security Breach

Caddy is an open source, cross-platform HTTP/Web server from Caddy Inc. Caddy suffers from a security vulnerability that stems from being susceptible to server-side request forgery SSRF attacks via the X-Forwarded-Host header...

Caddy Security Breach

Caddy is an open source, cross-platform HTTP/Web server from Caddy Inc. Caddy suffers from a security vulnerability that stems from improper input cleanup that makes it easy to bypass authentication by spoofing via the X-Forwarded-For header...

Caddy Security Breach

Caddy is an open source, cross-platform HTTP/Web server from Caddy. A security vulnerability exists in Caddy-geo-ip GeoIP version 0.6.0, which stems from a vulnerability that allows an attacker to spoof the source IP address of his/her source IP address via the X-Forwarded-For header when using t...

GO-2023-1567 Open redirect in github.com/caddyserver/caddy/v2

Due to improper request sanitization, a crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks...

SUSE CVE-2022-34037

An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service DoS via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an...

CVE-2022-34037

An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service DoS via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an...

Caddy 缓冲区错误漏洞

Caddy is an open source, cross-platform HTTP/Web server from Caddy. A buffer error vulnerability exists in Caddy v2.5.1, which originates from an out-of-bounds read in the rewrite function of /modules/caddyhttp/rewrite/rewrite.go. An attacker could use this vulnerability to cause a denial of...

Open Redirect

github.com/caddyserver/caddy is vulnerable to open redirect attacks. A remote unauthenticated attacker is able to redirect users to arbitrary web URLs by tricking the victim to click on specifically crafted links...

Caddy 输入验证错误漏洞

Caddy is an open source, cross-platform HTTP/Web server from Caddy Inc. A security vulnerability exists in Caddy version 2.4, which originates from an open redirection vulnerability. A remote attacker can exploit this vulnerability by tricking the victim user into clicking on a specially crafted...