Vulnerability GO-2026-6874
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
9 hours ago
November 05, 2026 at 10:54 PM UTC
Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through in github.com/caddyserver/caddy
<2.11.5
<2.11.5
Summary
Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through in github.com/caddyserver/caddy
Details
Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through in github.com/caddyserver/caddy
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
8 days ago
Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
<2.11.5 GHSA-8qx7-j2v2-x6q5
<2.11.5 GHSA-8qx7-j2v2-x6q5
Unknown
1 month ago
Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy
<2.11.4 GO-2026-6512
<2.11.4 GO-2026-6512
Medium Risk
1 month ago
Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass
<2.11.4 GHSA-j8px-rmrx-76h9
<2.11.4 GHSA-j8px-rmrx-76h9
Unknown
3 months ago
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy
<2.11.4 GO-2026-5346
<2.11.4 GO-2026-5346
Unknown
3 months ago
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy
<2.11.3 GO-2026-5408
<2.11.3 GO-2026-5408
Impacted packages
Timeline
Published
9 hours ago
November 05, 2026 at 10:54 PM UTC
Fixed (v2.11.5)
1 month ago
September 30, 2026 at 07:50 PM UTC
Last Modified
8 hours ago
November 05, 2026 at 11:15 PM UTC