Product by Debian

    Caddy

    10 known vulnerabilities in Caddy (Debian), 1 of them actively exploited (CISA KEV).

    Key figures

    10

    Vulnerabilities

    1

    Actively exploited (KEV)

    0

    Used by ransomware

    4

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Caddy (Debian)
    CriticalCVE-2023-44487

    HTTP/2 Rapid Reset Attack Vulnerability

    In CISA KEValso in 161 other products

    		7.5
    CriticalCVE-2026-27590

    Caddyserver Caddy: Incorrect Behavior Order: Validate Before Canonicalize

    also in 2 other products

    		9.8
    MediumCVE-2026-77281

    Caddy: rewrite placeholder re-expansion

    also in 2 other products

    		6.5
    HighCVE-2026-52845

    Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

    also in 3 other products

    		8.1
    CriticalCVE-2026-27588

    Caddyserver Caddy: Improper Handling of Case Sensitivity

    also in 2 other products

    		9.1
    CriticalCVE-2026-27587

    Caddyserver Caddy: Improper Handling of Case Sensitivity

    also in 2 other products

    		9.1
    MediumCVE-2026-27585

    Caddyserver Caddy: Improper Input Validation

    also in 2 other products

    		6.5
    MediumCVE-2026-27589

    Caddy vulnerable to cross-origin config application via local admin API /load (caddy)

    also in 2 other products

    		6.5
    MediumCVE-2026-52846

    Caddy: stripHTML template function bypass

    also in 3 other products

    		4.2
    MediumCVE-2026-45692

    Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization

    also in 2 other products

    		3.8

    All products by Debian