Behoben in
Version prüfen
caddy versionCVEs, die 0.10 betreffen
| CVE | Titel | CVSS | Ausgenutzt | EPSS | Veröffentlicht |
|---|---|---|---|---|---|
| CVE-2023-44487 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can... | 7.5 | KEV | 100.0% | 2023-10-10 |
| CVE-2018-21246 | Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused... | 9.8 | — | 2020-06-16 | |
| CVE-2026-27590 | Caddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusio... | 8.9 | — | 2026-02-25 | |
| CVE-2026-27586 | Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed | 8.8 | — | 2026-02-25 | |
| CVE-2026-52845 | Caddy: FastCGI header normalization bypass in `forward_auth copy_headers` | 8.1 | — | 2026-06-24 | |
| CVE-2026-52844 | Caddy: Windows `file_server` path authorization bypass via encoded backslash | 7.5 | — | 2026-06-24 | |
| CVE-2026-27585 | Caddy's improper sanitization of glob characters in file matcher may lead to bypassing security protections | 6.9 | — | 2026-02-25 | |
| CVE-2026-27589 | Caddy vulnerable to cross-origin config application via local admin API /load (caddy) | 6.9 | — | 2026-02-25 | |
| CVE-2022-29718 | Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exp... | 6.1 | — | 2022-06-02 | |
| CVE-2026-52846 | Caddy: stripHTML template function bypass | 4.2 | — | 2026-06-24 | |
| CVE-2018-19148 | Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers... | 3.7 | — | 2018-11-11 |
Verfolgen Sie diese Versionen auf Ihren eigenen Servern
InfraGuard erfasst die installierten Softwareversionen auf jedem Server und markiert diejenigen mit bekannten Schwachstellen. Self-Hosted – nichts verlässt Ihr Netzwerk.
Daten: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (siehe EPSS unter https://www.first.org/epss), endoflife.date. Softwareliste: awesome-selfhosted (CC BY-SA 3.0).