Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

requestbody

package

Go to main page

Versions in this module

v2

v2.11.4

Jun 1, 2026

v2.11.3

May 11, 2026 GO-2026-5346 +2 more

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.11.2

Mar 5, 2026 GO-2026-5346 +6 more

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5730: Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.11.1

Feb 20, 2026 GO-2026-4639 +8 more

GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5730: Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.11.0

Feb 20, 2026 GO-2026-4535 +14 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5730: Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.11.0-beta.2

Jan 5, 2026 GO-2026-4535 +13 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.11.0-beta.1

Dec 3, 2025 GO-2026-4535 +13 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.10.2

Aug 22, 2025 GO-2026-4535 +13 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.10.1

Aug 22, 2025 GO-2026-4535 +13 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.10.0

Apr 18, 2025 GO-2026-4535 +13 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Changes in this version

type RequestBody

+ Set string

v2.10.0-beta.4

Mar 25, 2025 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.10.0-beta.3

Mar 24, 2025 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.10.0-beta.2

Mar 8, 2025 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.10.0-beta.1

Mar 6, 2025 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.9.1

Jan 8, 2025 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.9.0

Dec 30, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.9.0-beta.3

Nov 5, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.9.0-beta.2

Oct 2, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.9.0-beta.1

Oct 2, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.8.4

Jun 2, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.8.3

Jun 2, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.8.2

Jun 2, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.8.1

May 30, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.8.0

May 28, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Changes in this version

type RequestBody

+ ReadTimeout time.Duration

+ WriteTimeout time.Duration

+ func (rb *RequestBody) Provision(ctx caddy.Context) error

v2.8.0-rc.1

May 20, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.8.0-beta.2

May 7, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.8.0-beta.1

Apr 30, 2024 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.7.6

Dec 7, 2023 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.7.5

Oct 11, 2023 GO-2026-4535 +12 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.7.4

Aug 17, 2023 GO-2026-4535 +11 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.7.3

Aug 6, 2023 GO-2026-4535 +11 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.7.2

Aug 3, 2023 GO-2026-4535 +11 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.7.1

Aug 3, 2023 GO-2026-4535 +11 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.7.0

Aug 2, 2023 GO-2026-4535 +11 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.7.0-beta.2

Jun 21, 2023 GO-2026-4535 +10 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.7.0-beta.1

May 16, 2023 GO-2026-4535 +10 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.6.4

Feb 14, 2023 GO-2026-4535 +10 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.6.3

Feb 8, 2023 GO-2026-4535 +10 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.6.2

Oct 13, 2022 GO-2026-4535 +10 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.6.1

Sep 21, 2022 GO-2026-4535 +10 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.6.0

Sep 20, 2022 GO-2026-4535 +10 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.6.0-beta.5

Sep 17, 2022 GO-2026-4535 +10 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.6.0-beta.4

Sep 16, 2022 GO-2026-4535 +10 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.6.0-beta.3

Sep 5, 2022 GO-2026-4535 +10 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.6.0-beta.2

Sep 5, 2022 GO-2026-4535 +10 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.6.0-beta.1

Sep 5, 2022 GO-2026-4535 +10 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.5.2

Jul 12, 2022 GO-2026-4535 +10 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.5.1

May 6, 2022 GO-2026-4535 +10 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.5.0

Apr 25, 2022 GO-2026-4535 +10 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.5.0-rc.1

Apr 13, 2022 GO-2026-4535 +10 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.5.0-beta.1

Mar 9, 2022 GO-2026-4535 +10 more

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.4.6

Nov 8, 2021 GO-2023-1567 +11 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.4.5

Sep 3, 2021 GO-2023-1567 +11 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.4.4

Aug 30, 2021 GO-2023-1567 +11 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.4.3

Jun 17, 2021 GO-2023-1567 +11 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.4.2

Jun 12, 2021 GO-2023-1567 +11 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.4.1

May 19, 2021 GO-2023-1567 +11 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.4.0

May 10, 2021 GO-2023-1567 +11 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

v2.4.0-rc.1

May 3, 2021 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.4.0-beta.2

Apr 1, 2021 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.4.0-beta.1

Feb 15, 2021 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.3.0

Dec 30, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.3.0-rc.2

Dec 30, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.3.0-rc.1

Dec 10, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.3.0-beta.1

Nov 30, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.3.0-1

Nov 23, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.2.3

Oct 13, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.2.2

Oct 26, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.2.1

Oct 13, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.2.0

Sep 23, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.2.0-rc.3

Sep 18, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.2.0-rc.2

Sep 17, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.2.0-rc.1

Aug 11, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.1.1

Jun 30, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.1.0

Jun 26, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.1.0-beta.2

Jun 26, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.1.0-beta.1

Jun 8, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0

May 2, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

Changes in this version

+ type RequestBody struct

+ MaxSize int64

+ func (RequestBody) CaddyModule() caddy.ModuleInfo

+ func (rb RequestBody) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyhttp.Handler) error

v2.0.0-test.4

Apr 2, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-rc.3

Apr 13, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-rc.2

Apr 9, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-rc.1

Apr 2, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-beta9

Nov 4, 2019 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-beta8

Oct 29, 2019 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-beta7

Oct 28, 2019 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-beta6

Oct 14, 2019 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-beta5

Oct 10, 2019 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-beta4

Oct 7, 2019 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-beta3

Oct 1, 2019 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-beta2

Sep 20, 2019 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-beta12

Jan 1, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-beta11

Dec 23, 2019 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-beta10

Nov 18, 2019 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-beta1

Sep 13, 2019 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-beta.20

Mar 24, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-beta.19

Mar 23, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-beta.18

Mar 19, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-beta.17

Mar 14, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-beta.16

Mar 13, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-beta.15

Feb 28, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-beta.14

Feb 9, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

v2.0.0-beta.13

Jan 22, 2020 GO-2023-1567 +10 more

GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy