Comprueba tu versión
caddy versionRamas de versiones afectadas
Vulnerabilidades conocidas
| CVE | Título | Versiones afectadas | CVSS | Explotada | EPSS | Publicación |
|---|---|---|---|---|---|---|
| CVE-2023-44487 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can... | < 2.7.5 * | 7.5 | KEV | 100.0% | 2023-10-10 |
| CVE-2026-55458 | Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through | * | 2.9 | — | 2026-11-06 | |
| CVE-2026-92700 | Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation | * | 6.3 | — | 2026-09-24 | |
| CVE-2026-92284 | Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS | * | 6.9 | — | 2026-09-24 | |
| CVE-2026-77281 | Caddy: rewrite placeholder re-expansion | * | 6.5 | — | 2026-09-18 | |
| CVE-2026-45135 | Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files | ≥ 2.7.0 < 2.11.3 * | 8.1 | — | 2026-06-24 | |
| CVE-2026-45692 | Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization | ≥ 2.4.0 < 2.11.3 * | 5.4 | — | 2026-06-24 | |
| CVE-2026-52845 | Caddy: FastCGI header normalization bypass in `forward_auth copy_headers` | < 2.11.4 ≤ 1.0.5 * | 8.1 | — | 2026-06-24 | |
| CVE-2026-52844 | Caddy: Windows `file_server` path authorization bypass via encoded backslash | < 2.11.4 ≤ 1.0.5 * | 7.5 | — | 2026-06-24 | |
| CVE-2026-52846 | Caddy: stripHTML template function bypass | < 2.11.4 ≤ 1.0.5 * | 4.2 | — | 2026-06-24 | |
| CVE-2026-30851 | Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privil... | ≥ 2.10.0 < 2.11.2 * | 8.1 | — | 2026-03-08 | |
| CVE-2026-30852 | Caddy: vars_regexp double-expands user input, leaking env vars and files | ≥ 2.7.5 < 2.11.2 * | 5.5 | — | 2026-03-08 | |
| CVE-2026-27590 | Caddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusio... | < 2.11.1 * | 8.9 | — | 2026-02-25 | |
| CVE-2026-27589 | Caddy vulnerable to cross-origin config application via local admin API /load (caddy) | < 2.11.1 * | 6.9 | — | 2026-02-25 | |
| CVE-2026-27588 | Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass | ≥ 2.10.2 < 2.11.1 * | 7.7 | — | 2026-02-25 | |
| CVE-2026-27587 | Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass | ≥ 2.10.2 < 2.11.1 * | 7.7 | — | 2026-02-25 | |
| CVE-2026-27586 | Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed | < 2.11.1 * | 8.8 | — | 2026-02-25 | |
| CVE-2026-27585 | Caddy's improper sanitization of glob characters in file matcher may lead to bypassing security protections | < 2.11.1 * | 6.9 | — | 2026-02-25 | |
| CVE-2023-50463 | The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used,... | ≤ 0.6.0 | 6.5 | — | 2023-12-10 | |
| CVE-2022-28923 | Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect us... | = 2.4.6 | 6.1 | — | 2023-02-06 | |
| CVE-2022-34037 | An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows... | = 2.5.1 * | 7.5 | — | 2022-07-22 | |
| CVE-2022-29718 | Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exp... | ≥ 2.4.0 < 2.5.0 < 2.5.0 * | 6.1 | — | 2022-06-02 | |
| CVE-2018-21246 | Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused... | < 0.10.3 < 0.10.13 * | 9.8 | — | 2020-06-16 | |
| CVE-2018-19148 | Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers... | ≤ 0.11.0 < 0.11.1 | 3.7 | — | 2018-11-11 |
Controla estas versiones en tus propios servidores
InfraGuard recopila las versiones de software instaladas en cada servidor y señala las que tienen vulnerabilidades conocidas. Autoalojado: nada sale de tu red.
Datos: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (consulta EPSS en https://www.first.org/epss), endoflife.date. Lista de software: awesome-selfhosted (CC BY-SA 3.0).