push

May 11, 2026 GO-2026-5346 +2 more

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

Mar 5, 2026 GO-2026-5346 +6 more

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5730: Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Feb 20, 2026 GO-2026-4639 +8 more

  GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5730: Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Feb 20, 2026 GO-2026-4535 +14 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5730: Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Jan 5, 2026 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Dec 3, 2025 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Aug 22, 2025 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Aug 22, 2025 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Apr 18, 2025 GO-2026-4535 +13 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Mar 25, 2025 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Mar 24, 2025 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Mar 8, 2025 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Mar 6, 2025 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Jan 8, 2025 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Dec 30, 2024 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Nov 5, 2024 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Oct 2, 2024 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Oct 2, 2024 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Jun 2, 2024 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Jun 2, 2024 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Jun 2, 2024 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

May 30, 2024 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

May 28, 2024 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

May 20, 2024 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

May 7, 2024 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Apr 30, 2024 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Dec 7, 2023 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Oct 11, 2023 GO-2026-4535 +12 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Aug 17, 2023 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Aug 6, 2023 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Aug 3, 2023 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Aug 3, 2023 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Aug 2, 2023 GO-2026-4535 +11 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5492: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Jun 21, 2023 GO-2026-4535 +10 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

May 16, 2023 GO-2026-4535 +10 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Feb 14, 2023 GO-2026-4535 +10 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Feb 8, 2023 GO-2026-4535 +10 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Oct 13, 2022 GO-2026-4535 +10 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Sep 21, 2022 GO-2026-4535 +10 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Sep 20, 2022 GO-2026-4535 +10 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Sep 17, 2022 GO-2026-4535 +10 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Sep 16, 2022 GO-2026-4535 +10 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Sep 5, 2022 GO-2026-4535 +10 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Sep 5, 2022 GO-2026-4535 +10 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Sep 5, 2022 GO-2026-4535 +10 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Jul 12, 2022 GO-2026-4535 +10 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

May 6, 2022 GO-2026-4535 +10 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Apr 25, 2022 GO-2026-4535 +10 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Apr 13, 2022 GO-2026-4535 +10 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Mar 9, 2022 GO-2026-4535 +10 more

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Nov 8, 2021 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Sep 3, 2021 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Aug 30, 2021 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Jun 17, 2021 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Jun 12, 2021 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

May 19, 2021 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

May 10, 2021 GO-2023-1567 +11 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

  GO-2026-5743: Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

May 3, 2021 GO-2023-1567 +10 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

Apr 1, 2021 GO-2023-1567 +10 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

Feb 15, 2021 GO-2023-1567 +10 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

Dec 30, 2020 GO-2023-1567 +10 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

Dec 30, 2020 GO-2023-1567 +10 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

Dec 10, 2020 GO-2023-1567 +10 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

Nov 30, 2020 GO-2023-1567 +10 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

Nov 23, 2020 GO-2023-1567 +10 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

Oct 13, 2020 GO-2023-1567 +10 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

Oct 26, 2020 GO-2023-1567 +10 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

Oct 13, 2020 GO-2023-1567 +10 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

Sep 23, 2020 GO-2023-1567 +10 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

Changes in this version

+ type Handler struct

+ Headers *HeaderConfig

+ Resources []Resource

+ func (Handler) CaddyModule() caddy.ModuleInfo

+ func (h *Handler) Provision(ctx caddy.Context) error

+ func (h Handler) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyhttp.Handler) error

+ type HeaderConfig struct

+ type Resource struct

+ Method string

+ Target string

Sep 18, 2020 GO-2023-1567 +10 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

Sep 17, 2020 GO-2023-1567 +10 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

Aug 11, 2020 GO-2023-1567 +10 more

  GO-2023-1567: Open redirect in github.com/caddyserver/caddy/v2

  GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

  GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

  GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

  GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

  GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

  GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2

  GO-2026-5346: Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

  GO-2026-5408: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

  GO-2026-5595: Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

  GO-2026-5660: Caddy: stripHTML template function bypass in github.com/caddyserver/caddy