caddyserver
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 20 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from November 10, 2018 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →Caddy: stripHTML template function bypass
Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
Caddy: Windows `file_server` path authorization bypass via encoded backslash
Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
Caddy: vars_regexp double-expands user input, leaking env vars and files
Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation
Caddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport
Caddy vulnerable to cross-origin config application via local admin API /load (caddy)
Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass
Monitor caddyserver in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.