CA
Product
caddy
On CISA KEVExploited in the wild
23
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 7Medium 9Low 2
Watch
Add caddy to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-92284 | 6.9 | Sep 23 | Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS Affected: <= 2.11.3 |
| CVE-2026-77281 | 6.5 | Sep 17 | Caddy: rewrite placeholder re-expansion Affected: < 2.11.4 |
| CVE-2026-27589 | 6.5 | Feb 24 | Caddy vulnerable to cross-origin config application via local admin API /load (caddy) Affected: < 2.11.1 |
| CVE-2026-27585 | 6.5 | Feb 24 | Caddy's improper sanitization of glob characters in file matcher may lead to bypassing security protections Affected: < 2.11.1 |
| CVE-2023-50463 | 6.5 | Dec 10 | The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof their source IP address via an… Affected: through 0.6.0 |
| CVE-2026-92700 | 6.3 | Sep 23 | Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation Affected: <= 2.11.3 |
| CVE-2022-28923 | 6.1 | Feb 6 | Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs Affected: 2.4.6 |
| CVE-2022-29718 | 6.1 | Jun 2 | Caddy v2.4 was discovered to contain an open redirect vulnerability Affected: 2.4.0 before 2.5.0 |
| CVE-2026-52846 | 4.2 | Jun 23 | Caddy: stripHTML template function bypass Affected: < 2.11.4 |
Showing 9