GO-2026-4535: Improper sanitization of glob characters in github.com/caddyserver/caddy/v2
GO-2026-4536: Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2
GO-2026-4537: Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2
GO-2026-4538: Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2
GO-2026-4539: Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2
GO-2026-4541: Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2
GO-2026-4639: Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy
GO-2026-4644: Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy