Vendor

    Caddyserver

    23 known vulnerabilities in products by Caddyserver, 1 of them actively exploited (CISA KEV).

    Key figures

    23

    Vulnerabilities

    1

    Actively exploited (KEV)

    0

    Used by ransomware

    6

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Caddyserver
    CriticalCVE-2023-44487

    HTTP/2 Rapid Reset Attack Vulnerability

    In CISA KEValso in 158 other products

    		7.5
    CriticalCVE-2018-21246

    Caddyserver Caddy: Authentication Bypass

    also in 1 other product

    		9.8
    CriticalCVE-2026-27590

    Caddyserver Caddy: Incorrect Behavior Order: Validate Before Canonicalize

    also in 2 other products

    		9.8
    HighCVE-2026-45135

    Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

    also in 1 other product

    		8.1
    HighCVE-2026-52844

    Caddy: Windows `file_server` path authorization bypass via encoded backslash

    also in 2 other products

    		7.5
    MediumCVE-2022-28923

    Caddyserver Caddy: Open Redirect

    also in 1 other product

    		6.1
    HighCVE-2022-34037

    Caddyserver Caddy: Out-of-Bounds Read

    also in 1 other product

    		7.5
    MediumCVE-2026-77281

    Caddy: rewrite placeholder re-expansion

    also in 2 other products

    		6.5
    HighCVE-2026-52845

    Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

    also in 3 other products

    		8.1
    MediumCVE-2026-92284

    Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS

    also in 1 other product

    		—
    CriticalCVE-2026-27588

    Caddyserver Caddy: Improper Handling of Case Sensitivity

    also in 2 other products

    		9.1
    CriticalCVE-2026-27587

    Caddyserver Caddy: Improper Handling of Case Sensitivity

    also in 2 other products

    		9.1
    MediumCVE-2026-92700

    Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation

    also in 1 other product

    		—
    MediumCVE-2022-29718

    Caddyserver Caddy: Open Redirect

    also in 2 other products

    		6.1
    CriticalCVE-2026-27586

    Caddyserver Caddy: Improper Handling of Exceptional Conditions

    also in 1 other product

    		9.1
    HighCVE-2026-30852

    Caddy: vars_regexp double-expands user input, leaking env vars and files

    also in 1 other product

    		7.5
    HighCVE-2026-30851

    Caddyserver Caddy: Improper Authentication

    also in 1 other product

    		8.1
    MediumCVE-2023-50463

    Caddyserver Caddy: security vulnerability

    also in 1 other product

    		6.5
    MediumCVE-2026-27585

    Caddyserver Caddy: Improper Input Validation

    also in 2 other products

    		6.5
    MediumCVE-2026-27589

    Caddy vulnerable to cross-origin config application via local admin API /load (caddy)

    also in 2 other products

    		6.5
    LowCVE-2018-19148

    Caddyserver Caddy: security vulnerability

    also in 1 other product

    		3.7
    MediumCVE-2026-52846

    Caddy: stripHTML template function bypass

    also in 3 other products

    		4.2
    MediumCVE-2026-45692

    Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization

    also in 2 other products

    		3.8

    Products

    Products by Caddyserver
    Caddyserver Caddy231