reverseproxy

Oct 3, 2026

Changes in this version

+ type ContentLengthRequiredTransport interface

+ RequiresContentLength func() bool

type Handler

+ ProxyStatusName string

Sep 30, 2026

Changes in this version

type WeightedRoundRobinSelection

+ func (r *WeightedRoundRobinSelection) Validate() error

May 11, 2026 GO-2026-5346 +3 more

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Changes in this version

+ type CachingUpstreamSource interface

+ ResetCache func(*http.Request) error

type Handler

+ StreamBufferSize int

type SRVUpstreams

+ func (su *SRVUpstreams) ResetCache(r *http.Request) error

Mar 5, 2026 GO-2026-5346 +7 more

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5730: Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Feb 20, 2026 GO-2026-4639 +9 more

  GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5730: Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Feb 20, 2026 GO-2026-4535 +15 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5730: Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Changes in this version

+ type BufferedTransport interface

+ DefaultBufferSizes func() (int64, int64)

+ type H2CTransport interface

+ EnableH2C func() error

type HTTPTransport

+ func (h *HTTPTransport) EnableH2C() error

+ func (h *HTTPTransport) RequestHeaderOps() *headers.HeaderOps

+ func (h HTTPTransport) OverrideHealthCheckScheme(base *url.URL, port string)

+ func (h HTTPTransport) ProxyProtocolEnabled() bool

+ type HealthCheckSchemeOverriderTransport interface

+ OverrideHealthCheckScheme func(base *url.URL, port string)

+ type ProxyProtocolTransport interface

+ ProxyProtocolEnabled func() bool

+ type RequestHeaderOpsTransport interface

+ RequestHeaderOps func() *headers.HeaderOps

type SRVUpstreams

+ DialNetwork string

Jan 5, 2026 GO-2026-4535 +14 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Dec 3, 2025 GO-2026-4535 +14 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Aug 22, 2025 GO-2026-4535 +14 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Aug 22, 2025 GO-2026-4535 +14 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Apr 18, 2025 GO-2026-4535 +14 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Changes in this version

type HTTPTransport

+ NetworkProxyRaw json.RawMessage

Mar 25, 2025 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Mar 24, 2025 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Mar 8, 2025 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Mar 6, 2025 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Jan 8, 2025 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Dec 30, 2024 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Changes in this version

type ActiveHealthChecks

+ Body string

+ Method string

+ Upstream string

type CookieHashSelection

+ MaxAge caddy.Duration

type HTTPTransport

+ LocalAddress string

Nov 5, 2024 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Oct 2, 2024 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Oct 2, 2024 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Jun 2, 2024 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Jun 2, 2024 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Jun 2, 2024 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

May 30, 2024 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

May 28, 2024 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Changes in this version

type ActiveHealthChecks

+ Fails int

+ FollowRedirects bool

+ Passes int

type HTTPTransport

+ ForwardProxyURL string

type SRVUpstreams

+ GracePeriod caddy.Duration

type TLSConfig

+ CARaw json.RawMessage

+ Curves []string

May 20, 2024 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

May 7, 2024 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Apr 30, 2024 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Dec 7, 2023 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Oct 11, 2023 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Changes in this version

type Handler

+ VerboseLogs bool

Aug 17, 2023 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Aug 6, 2023 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Aug 3, 2023 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Aug 3, 2023 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Aug 2, 2023 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Changes in this version

type AUpstreams

+ Versions *IPVersions

type ActiveHealthChecks

+ func (a *ActiveHealthChecks) IsEnabled() bool

+ func (a *ActiveHealthChecks) Provision(ctx caddy.Context, h *Handler) error

+ type ClientIPHashSelection struct

+ func (ClientIPHashSelection) CaddyModule() caddy.ModuleInfo

+ func (ClientIPHashSelection) Select(pool UpstreamPool, req *http.Request, _ http.ResponseWriter) *Upstream

+ func (r *ClientIPHashSelection) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

type CookieHashSelection

+ FallbackRaw json.RawMessage

+ func (s *CookieHashSelection) Provision(ctx caddy.Context) error

type HTTPTransport

+ ProxyProtocol string

type Handler

+ StreamCloseDelay caddy.Duration

+ StreamTimeout caddy.Duration

type HeaderHashSelection

+ FallbackRaw json.RawMessage

+ func (s *HeaderHashSelection) Provision(ctx caddy.Context) error

+ type IPVersions struct

+ IPv4 *bool

+ IPv6 *bool

+ type ProxyProtocolInfo struct

+ AddrPort netip.AddrPort

+ type QueryHashSelection struct

+ FallbackRaw json.RawMessage

+ Key string

+ func (QueryHashSelection) CaddyModule() caddy.ModuleInfo

+ func (s *QueryHashSelection) Provision(ctx caddy.Context) error

+ func (s *QueryHashSelection) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

+ func (s QueryHashSelection) Select(pool UpstreamPool, req *http.Request, _ http.ResponseWriter) *Upstream

+ type WeightedRoundRobinSelection struct

+ Weights []int

+ func (WeightedRoundRobinSelection) CaddyModule() caddy.ModuleInfo

+ func (r *WeightedRoundRobinSelection) Provision(ctx caddy.Context) error

+ func (r *WeightedRoundRobinSelection) Select(pool UpstreamPool, _ *http.Request, _ http.ResponseWriter) *Upstream

+ func (r *WeightedRoundRobinSelection) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

Jun 21, 2023 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

May 16, 2023 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Feb 14, 2023 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Changes in this version

type Handler

+ DeprecatedBufferRequests bool

+ DeprecatedBufferResponses bool

+ DeprecatedMaxBufferSize int64

+ RequestBuffers int64

+ ResponseBuffers int64

Feb 8, 2023 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Oct 13, 2022 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Sep 21, 2022 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Sep 20, 2022 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Changes in this version

type HTTPTransport

+ ReadTimeout caddy.Duration

+ WriteTimeout caddy.Duration

type LoadBalancing

+ Retries int

+ type MultiUpstreams struct

+ SourcesRaw []json.RawMessage

+ func (MultiUpstreams) CaddyModule() caddy.ModuleInfo

+ func (mu *MultiUpstreams) Provision(ctx caddy.Context) error

+ func (mu MultiUpstreams) GetUpstreams(r *http.Request) ([]*Upstream, error)

+ func (u *MultiUpstreams) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

Sep 17, 2022 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Sep 16, 2022 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Sep 5, 2022 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Sep 5, 2022 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Sep 5, 2022 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Jul 12, 2022 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Changes in this version

type TLSConfig

+ ExceptPorts []string

+ Renegotiation string

May 6, 2022 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Changes in this version

type Handler

+ Rewrite *rewrite.Rewrite

Apr 25, 2022 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Changes in this version

+ type AUpstreams struct

+ DialTimeout caddy.Duration

+ FallbackDelay caddy.Duration

+ Name string

+ Port string

+ Refresh caddy.Duration

+ Resolver *UpstreamResolver

+ func (AUpstreams) CaddyModule() caddy.ModuleInfo

+ func (au *AUpstreams) Provision(_ caddy.Context) error

+ func (au AUpstreams) GetUpstreams(r *http.Request) ([]*Upstream, error)

+ func (au AUpstreams) String() string

+ func (u *AUpstreams) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

+ type CopyResponseHandler struct

+ StatusCode caddyhttp.WeakString

+ func (CopyResponseHandler) CaddyModule() caddy.ModuleInfo

+ func (h *CopyResponseHandler) Provision(ctx caddy.Context) error

+ func (h *CopyResponseHandler) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

+ func (h CopyResponseHandler) ServeHTTP(rw http.ResponseWriter, req *http.Request, _ caddyhttp.Handler) error

+ type CopyResponseHeadersHandler struct

+ Exclude []string

+ Include []string

+ func (CopyResponseHeadersHandler) CaddyModule() caddy.ModuleInfo

+ func (h *CopyResponseHeadersHandler) Provision(ctx caddy.Context) error

+ func (h *CopyResponseHeadersHandler) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

+ func (h *CopyResponseHeadersHandler) Validate() error

+ func (h CopyResponseHeadersHandler) ServeHTTP(rw http.ResponseWriter, req *http.Request, next caddyhttp.Handler) error

type Handler

+ DynamicUpstreams UpstreamSource

+ DynamicUpstreamsRaw json.RawMessage

+ TrustedProxies []string

+ type SRVUpstreams struct

+ DialTimeout caddy.Duration

+ FallbackDelay caddy.Duration

+ Name string

+ Proto string

+ Refresh caddy.Duration

+ Resolver *UpstreamResolver

+ Service string

+ func (SRVUpstreams) CaddyModule() caddy.ModuleInfo

+ func (su *SRVUpstreams) Provision(ctx caddy.Context) error

+ func (su SRVUpstreams) GetUpstreams(r *http.Request) ([]*Upstream, error)

+ func (su SRVUpstreams) String() string

+ func (u *SRVUpstreams) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

type UpstreamResolver

+ func (u *UpstreamResolver) ParseAddresses() error

+ type UpstreamSource interface

+ GetUpstreams func(*http.Request) ([]*Upstream, error)

Apr 13, 2022 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Mar 9, 2022 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Nov 8, 2021 GO-2023-1567 +12 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Sep 3, 2021 GO-2023-1567 +12 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Aug 30, 2021 GO-2023-1567 +12 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Jun 17, 2021 GO-2023-1567 +12 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Jun 12, 2021 GO-2023-1567 +12 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

May 19, 2021 GO-2023-1567 +12 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

May 10, 2021 GO-2023-1567 +12 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Changes in this version

type ActiveHealthChecks

+ URI string

type Handler

+ BufferResponses bool

+ MaxBufferSize int64

+ func (h *Handler) FinalizeUnmarshalCaddyfile(helper httpcaddyfile.Helper) error

May 3, 2021 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Apr 1, 2021 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Feb 15, 2021 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Dec 30, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Changes in this version

+ type CookieHashSelection struct

+ Name string

+ Secret string

+ func (CookieHashSelection) CaddyModule() caddy.ModuleInfo

+ func (s *CookieHashSelection) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

+ func (s CookieHashSelection) Select(pool UpstreamPool, req *http.Request, w http.ResponseWriter) *Upstream

type HTTPTransport

+ MaxIdleConnsPerHost int

Dec 30, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Dec 10, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Nov 30, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Nov 23, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Oct 13, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Oct 26, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Oct 13, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Sep 23, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Changes in this version

type HTTPTransport

+ Resolver *UpstreamResolver

+ type UpstreamResolver struct

+ Addresses []string

Sep 18, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Sep 17, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Aug 11, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Jun 30, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Jun 26, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Changes in this version

type Handler

+ HandleResponse []caddyhttp.ResponseHandler

type TLSConfig

+ ClientCertificateAutomate string

Jun 26, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Jun 8, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

May 2, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Changes in this version

+ type ActiveHealthChecks struct

+ ExpectBody string

+ ExpectStatus int

+ Headers http.Header

+ Interval caddy.Duration

+ MaxSize int64

+ Path string

+ Port int

+ Timeout caddy.Duration

+ type CircuitBreaker interface

+ OK func() bool

+ RecordMetric func(statusCode int, latency time.Duration)

+ type DialError struct

+ type DialInfo struct

+ Address string

+ Host string

+ Network string

+ Port string

+ Upstream *Upstream

+ func GetDialInfo(ctx context.Context) (DialInfo, bool)

+ func (di DialInfo) String() string

+ type FirstSelection struct

+ func (FirstSelection) CaddyModule() caddy.ModuleInfo

+ func (FirstSelection) Select(pool UpstreamPool, _ *http.Request) *Upstream

+ func (r *FirstSelection) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

+ type HTTPTransport struct

+ Compression *bool

+ DialTimeout caddy.Duration

+ ExpectContinueTimeout caddy.Duration

+ FallbackDelay caddy.Duration

+ KeepAlive *KeepAlive

+ MaxConnsPerHost int

+ MaxResponseHeaderSize int64

+ ReadBufferSize int

+ ResponseHeaderTimeout caddy.Duration

+ TLS *TLSConfig

+ Transport *http.Transport

+ Versions []string

+ WriteBufferSize int

+ func (HTTPTransport) CaddyModule() caddy.ModuleInfo

+ func (h *HTTPTransport) EnableTLS(base *TLSConfig) error

+ func (h *HTTPTransport) NewTransport(_ caddy.Context) (*http.Transport, error)

+ func (h *HTTPTransport) Provision(ctx caddy.Context) error

+ func (h *HTTPTransport) RoundTrip(req *http.Request) (*http.Response, error)

+ func (h *HTTPTransport) SetScheme(req *http.Request)

+ func (h *HTTPTransport) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

+ func (h HTTPTransport) Cleanup() error

+ func (h HTTPTransport) TLSEnabled() bool

+ type Handler struct

+ BufferRequests bool

+ CB CircuitBreaker

+ CBRaw json.RawMessage

+ FlushInterval caddy.Duration

+ Headers *headers.Handler

+ HealthChecks *HealthChecks

+ LoadBalancing *LoadBalancing

+ Transport http.RoundTripper

+ TransportRaw json.RawMessage

+ Upstreams UpstreamPool

+ func (Handler) CaddyModule() caddy.ModuleInfo

+ func (h *Handler) Cleanup() error

+ func (h *Handler) Provision(ctx caddy.Context) error

+ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyhttp.Handler) error

+ func (h *Handler) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

+ type HeaderHashSelection struct

+ Field string

+ func (HeaderHashSelection) CaddyModule() caddy.ModuleInfo

+ func (s *HeaderHashSelection) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

+ func (s HeaderHashSelection) Select(pool UpstreamPool, req *http.Request) *Upstream

+ type HealthChecks struct

+ Active *ActiveHealthChecks

+ Passive *PassiveHealthChecks

+ type Host interface

+ CountFail func(int) error

+ CountRequest func(int) error

+ Fails func() int

+ NumRequests func() int

+ SetHealthy func(bool) (bool, error)

+ Unhealthy func() bool

+ type IPHashSelection struct

+ func (IPHashSelection) CaddyModule() caddy.ModuleInfo

+ func (IPHashSelection) Select(pool UpstreamPool, req *http.Request) *Upstream

+ func (r *IPHashSelection) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

+ type KeepAlive struct

+ Enabled *bool

+ IdleConnTimeout caddy.Duration

+ MaxIdleConns int

+ MaxIdleConnsPerHost int

+ ProbeInterval caddy.Duration

+ type LeastConnSelection struct

+ func (LeastConnSelection) CaddyModule() caddy.ModuleInfo

+ func (LeastConnSelection) Select(pool UpstreamPool, _ *http.Request) *Upstream

+ func (r *LeastConnSelection) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

+ type LoadBalancing struct

+ RetryMatch caddyhttp.MatcherSets

+ RetryMatchRaw caddyhttp.RawMatcherSets

+ SelectionPolicy Selector

+ SelectionPolicyRaw json.RawMessage

+ TryDuration caddy.Duration

+ TryInterval caddy.Duration

+ type PassiveHealthChecks struct

+ FailDuration caddy.Duration

+ MaxFails int

+ UnhealthyLatency caddy.Duration

+ UnhealthyRequestCount int

+ UnhealthyStatus []int

+ type RandomChoiceSelection struct

+ Choose int

+ func (RandomChoiceSelection) CaddyModule() caddy.ModuleInfo

+ func (r *RandomChoiceSelection) Provision(ctx caddy.Context) error

+ func (r *RandomChoiceSelection) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

+ func (r RandomChoiceSelection) Select(pool UpstreamPool, _ *http.Request) *Upstream

+ func (r RandomChoiceSelection) Validate() error

+ type RandomSelection struct

+ func (RandomSelection) CaddyModule() caddy.ModuleInfo

+ func (r *RandomSelection) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

+ func (r RandomSelection) Select(pool UpstreamPool, request *http.Request) *Upstream

+ type RoundRobinSelection struct

+ func (RoundRobinSelection) CaddyModule() caddy.ModuleInfo

+ func (r *RoundRobinSelection) Select(pool UpstreamPool, _ *http.Request) *Upstream

+ func (r *RoundRobinSelection) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

+ type Selector interface

+ Select func(UpstreamPool, *http.Request) *Upstream

+ type TLSConfig struct

+ ClientCertificateFile string

+ ClientCertificateKeyFile string

+ HandshakeTimeout caddy.Duration

+ InsecureSkipVerify bool

+ RootCAPEMFiles []string

+ RootCAPool []string

+ ServerName string

+ func (t TLSConfig) MakeTLSClientConfig() (*tls.Config, error)

+ type TLSTransport interface

+ EnableTLS func(base *TLSConfig) error

+ TLSEnabled func() bool

+ type URIHashSelection struct

+ func (URIHashSelection) CaddyModule() caddy.ModuleInfo

+ func (URIHashSelection) Select(pool UpstreamPool, req *http.Request) *Upstream

+ func (r *URIHashSelection) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

+ type Upstream struct

+ Dial string

+ LookupSRV string

+ MaxRequests int

+ func (u *Upstream) Available() bool

+ func (u *Upstream) Full() bool

+ func (u *Upstream) Healthy() bool

+ func (u Upstream) String() string

+ type UpstreamPool []*Upstream

Apr 2, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Apr 13, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Apr 9, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Apr 2, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Nov 4, 2019 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Oct 29, 2019 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Oct 28, 2019 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Oct 14, 2019 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Oct 10, 2019 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Oct 7, 2019 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Oct 1, 2019 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Sep 20, 2019 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Jan 1, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Dec 23, 2019 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Nov 18, 2019 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Sep 13, 2019 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Mar 24, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Mar 23, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Mar 19, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Mar 14, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Mar 13, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Feb 28, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Feb 9, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Jan 22, 2020 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-6512: Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy