Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

intercept

package

Go to main page

Versions in this module

v2

v2.11.4

Jun 1, 2026

v2.11.3

May 11, 2026 GO-2026-5346 +2 more

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.11.2

Mar 5, 2026 GO-2026-5346 +6 more

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5730: Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.11.1

Feb 20, 2026 GO-2026-4639 +8 more

GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5730: Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.11.0

Feb 20, 2026 GO-2026-4535 +14 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5730: Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.11.0-beta.2

Jan 5, 2026 GO-2026-4535 +13 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.11.0-beta.1

Dec 3, 2025 GO-2026-4535 +13 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.10.2

Aug 22, 2025 GO-2026-4535 +13 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.10.1

Aug 22, 2025 GO-2026-4535 +13 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.10.0

Apr 18, 2025 GO-2026-4535 +13 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.10.0-beta.4

Mar 25, 2025 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.10.0-beta.3

Mar 24, 2025 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.10.0-beta.2

Mar 8, 2025 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.10.0-beta.1

Mar 6, 2025 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.9.1

Jan 8, 2025 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.9.0

Dec 30, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.9.0-beta.3

Nov 5, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.9.0-beta.2

Oct 2, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.9.0-beta.1

Oct 2, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.8.4

Jun 2, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.8.3

Jun 2, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.8.2

Jun 2, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.8.1

May 30, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.8.0

May 28, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Changes in this version

+ type Intercept struct

+ HandleResponse []caddyhttp.ResponseHandler

+ func (Intercept) CaddyModule() caddy.ModuleInfo

+ func (i *Intercept) FinalizeUnmarshalCaddyfile(helper httpcaddyfile.Helper) error

+ func (i *Intercept) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

+ func (ir Intercept) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyhttp.Handler) error

+ func (irh *Intercept) Provision(ctx caddy.Context) error

v2.8.0-rc.1

May 20, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy