6.5
Moyenne
CVE-2026-77281 Caddy is an extensible server platform that uses TLS by default
Description
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite() can pass attacker-controlled replacement bytes through buildQueryString for a second placeholder expansion when a rewrite URI ends with a literal question mark, allowing injected environment or request-variable placeholders to disclose data and, when the file provider is registered, allowing injected file placeholders to disclose readable files. The issue is fixed in version 2.11.4.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| caddy 2.11 | premières → < 2.11.4 | 2.11.4 |
Références
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de caddy
Les 17 CVE de caddy →
CVE-2026-55458
Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
2.9
Faible
CVE-2026-92700
Caddy is an extensible server platform that uses TLS by default
6.3
Moyenne
CVE-2026-92284
Caddy is an extensible server platform that uses TLS by default
6.9
Moyenne
CVE-2026-45135
Caddy is an extensible server platform that uses TLS by default
8.1
Élevée