MEDIUM6.1Go
GHSA-2927-hv3p-f3vp· CVE-2022-29718Open redirect in caddy
Modified: 9/10/2026
package
Go/github.com/caddyserver/caddy
pkg:go/github.com/caddyserver/caddy
HIGH8.1Go
GHSA-f59h-q822-g45g· CVE-2026-52845, GO-2026-5346Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
Modified: 7/24/2026
CRITICAL9.8Go
GHSA-gr7w-x2jp-3xgw· CVE-2018-21246, GO-2020-0043Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication
Modified: 11/8/2023
LOW3.7Go
GHSA-jf2w-mq6r-56v8· CVE-2018-19148Caddy allows enumeration of Certificates and Hostnames
Modified: 4/24/2024
HIGH7.5Go
GHSA-qrp7-cvwr-j2c6· CVE-2026-52844, GO-2026-5595Caddy: Windows `file_server` path authorization bypass via encoded backslash
Modified: 7/24/2026
MEDIUM4.2Go
GHSA-vcc4-2c75-vc9v· CVE-2026-52846, GO-2026-5660Caddy: stripHTML template function bypass
Modified: 7/24/2026