CVE Tools
Track your stack

Github.com/caddyserver/caddy/v2

10 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Github.com/caddyserver/caddy/v2, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Github.com/caddyserver/caddy/v2 CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Github.com/caddyserver/caddy/v2 CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-026
2026-030
2026-040
2026-052
2026-060
2026-070
2026-080
2026-090
2026-100

Severity

How the 10 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical450%
  • Medium450%

Latest CVEs

The 10 most recently published vulnerabilities affecting Github.com/caddyserver/caddy/v2.

  1. GHSA-gx7w-56w6-g48xCaddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching—
  2. GHSA-wwhq-w58m-w29cCaddy CVE-2026-30852 Fix Bypass—
  3. CVE-2026-27590Caddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport9.8
  4. CVE-2026-27589Caddy vulnerable to cross-origin config application via local admin API /load (caddy)6.5
  5. CVE-2026-27588Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass9.1
  6. CVE-2026-27587Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass9.1
  7. CVE-2026-27586Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed9.1
  8. CVE-2026-27585Caddy's improper sanitization of glob characters in file matcher may lead to bypassing security protections6.5
  9. CVE-2022-28923Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs.6.1
  10. CVE-2022-29718Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim ...6.1

Product grouping is registry-driven, with AI assist and human review. How it works