CA
Product
caddy
On CISA KEVExploited in the wild
23
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 7Medium 9Low 2
Watch
Add caddy to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-27590 | 9.8 | Feb 24 | Caddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport Affected: < 2.11.1 |
| CVE-2018-21246 | 9.8 | Jun 15 | Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode Affected: before 0.10.3 |
| CVE-2026-27588 | 9.1 | Feb 24 | Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass Affected: < 2.11.1 |
| CVE-2026-27587 | 9.1 | Feb 24 | Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass Affected: < 2.11.1 |
| CVE-2026-27586 | 9.1 | Feb 24 | Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed Affected: < 2.11.1 |
Showing 5