Caddy
Vendor:
First CVE: Nov 10, 2018 · Active for 7 years
20
Total CVEs
More Total CVEs than 94% of tracked products
4.0
Avg CVEs / Year
Higher CVE frequency than 83% of tracked products
7.3
Avg CVSS
Higher Avg CVSS than 46% of tracked products
5.0%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Caddy over time
Volume of CVEsAvg CVSS Base Score
First CVE
Nov 10, 2018
7 years ago
Most Recent CVE
Jun 23, 2026
31 days ago
CVE Severity & Scoring
Caddy20 CVEs
10%
30%
35%
25%
All CVEs352,231 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local0 (0.0%)
Network20 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low17 (85.0%)
High3 (15.0%)
Unknown0 (0.0%)
User Interaction
None15 (75.0%)
Unknown0 (0.0%)
Required5 (25.0%)
Privileges Required
Low2 (10.0%)
High1 (5.0%)
None17 (85.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (20 CVEs).
20 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-44487HIGH The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through | Oct 10, 2023 | 7.5 | 97 | YES | YES |
CVE-2026-52845HIGH Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the tru | Jun 23, 2026 | 8.1 | 35 | NO | NO |
CVE-2026-52844HIGH Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server l | Jun 23, 2026 | 7.5 | 35 | NO | NO |
CVE-2026-45135HIGH Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go mi | Jun 23, 2026 | 8.1 | 34 | NO | NO |
CVE-2026-27590CRITICAL Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the | Feb 24, 2026 | 9.8 | 32 | NO | NO |
CVE-2018-21246CRITICAL Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode. | Jun 15, 2020 | 9.8 | 31 | NO | NO |
CVE-2026-27588CRITICAL Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request matcher is documented as case-insensitive, but when configured | Feb 24, 2026 | 9.1 | 30 | NO | NO |
CVE-2022-28923MEDIUM Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs. | Feb 6, 2023 | 6.1 | 30 | NO | YES |
CVE-2026-30851HIGH Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, all | Mar 7, 2026 | 8.8 | 29 | NO | NO |
CVE-2026-27587CRITICAL Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request matcher is intended to be case-insensitive, but when the match | Feb 24, 2026 | 9.1 | 29 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (20 CVEs).
CISA KEV
1 CVE
5.0% of CVEs· 97th percentile
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
5.0% of CVEs· 97th percentile
ExploitDB
1 CVE
5.0% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (20 CVEs).
Media Mentions
Signals from CVEs in this product scope (20 CVEs).
Top CNAs Publishing CVEs For Caddy
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2.5.1 | 1 | 7.5 | 1.1% | 0 | 0 |
| 2.4.6 | 1 | 6.1 | 1.4% | 0 | 1 |