Caddyserver Caddy vulnerabilities

CVE-2026-52846 [MEDIUM] CWE-116 CVE-2026-52846: Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HT

CVE-2026-45692 [LOW] CWE-187 CVE-2026-45692: Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the author Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different config object during traversal. This happens because the aut

CVE-2018-19148 [LOW] CWE-200 CVE-2018-19148: Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames. Specifically, when unable to match a Host header with a vhost in its configuration, it serves the X.509 certificate for a randomly selected vhost in its configuration. Repeated requests (with a nonexistent hostname in t