HTTP/2 Rapid Reset Attack Vulnerability

Caddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport

Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode

Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass

Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass

Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed

Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation

Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

Caddy: Windows `file_server` path authorization bypass via encoded backslash

Caddy: vars_regexp double-expands user input, leaking env vars and files

An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI

Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS

Caddy: rewrite placeholder re-expansion

Caddy vulnerable to cross-origin config application via local admin API /load (caddy)

Caddy's improper sanitization of glob characters in file matcher may lead to bypassing security protections

The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof their source IP address via an…

Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation

Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs

Caddy v2.4 was discovered to contain an open redirect vulnerability

Caddy: stripHTML template function bypass

Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization

Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames