Github.Com Caddyserver Caddy vulnerabilities

CVE-2018-21246 [CRITICAL] CWE-287 Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.

CVE-2026-52844 [MEDIUM] CWE-22 Caddy: Windows `file_server` path authorization bypass via encoded backslash Caddy: Windows `file_server` path authorization bypass via encoded backslash ### Summary On Windows, Caddy `path` matchers treat `/private\secret.txt` as outside `/private/*`, but `file_server` later resolves the same request path as `private\secret.txt` on disk. An unauthenticated remote client can request `/private%5csecret.txt` and bypass Caddy path-scoped auth/deny routes protecting

CVE-2026-52845 [HIGH] CWE-287 Caddy: FastCGI header normalization bypass in `forward_auth copy_headers` Caddy: FastCGI header normalization bypass in `forward_auth copy_headers` ### Summary `forward_auth copy_headers` deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through `php_fastcgi`, Caddy normalizes HTTP headers into CGI variables by replacing `-` with `_`. This lets a client send an underscore alia

CVE-2022-34037 [HIGH] CWE-125 Withdrawn Advisory: Out-of-bounds Read can lead to client side denial of service Withdrawn Advisory: Out-of-bounds Read can lead to client side denial of service ## Withdrawn Advisory This advisory has been withdrawn because it is a bug, not a vulnerability. According to the maintainer, the bug only affects the client side of the request and cannot cause a denial of service on the server. ## Original Description An out-of-bounds read in the rewrite function at /mo

CVE-2022-29718 [MEDIUM] CWE-601 Open redirect in caddy Open redirect in caddy Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.

CVE-2026-52846 [MEDIUM] CWE-116 Caddy: stripHTML template function bypass Caddy: stripHTML template function bypass ### Summary Caddy’s `stripHTML` template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as `img src=x onerror=alert()>`, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. ---

CVE-2018-19148 [LOW] CWE-200 Caddy allows enumeration of Certificates and Hostnames Caddy allows enumeration of Certificates and Hostnames Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames. Specifically, when unable to match a Host header with a vhost in its configuration, it serves the X.509 certificate for a randomly selected vhost in its configuration. Repeated requests (with a nonexistent hostname in the Hos