products / caddy

Caddy

Caddy is an HTTP server and reverse proxy written in Go. It defaults to automatic HTTPS via Let's Encrypt and uses a declarative Caddyfile for site configuration. Deployments commonly place it at the edge for TLS termination, static hosting, and proxying to application backends. NVD tracks the product as caddyserver:caddy. The published CVE set is smaller than older reverse proxies, with the industry-wide HTTP/2 Rapid Reset advisory as the highest-impact modern entry.

api usage

Querying Caddy

product slugcaddy

version format2.11.4, 2.6.0, 2.5.2

bash

curl "https://api.attestd.io/v1/check?product=caddy&version=2.6.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Caddy 2.6.0 is affected by CVE-2023-44487 (HTTP/2 Rapid Reset). The response returns risk_state: "high" with denial-of-service risk factors and fixed_version: "2.7.5".

json

{
  "product": "caddy",
  "version": "2.6.0",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": [
    "active_exploitation",
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": true,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": "2.11.4",
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2023-44487",
    "CVE-2026-27585",
    "CVE-2026-27586",
    "CVE-2026-27589",
    "CVE-2026-27590",
    "CVE-2026-45692",
    "CVE-2026-52844",
    "CVE-2026-52845",
    "CVE-2026-52846"
  ],
  "cves": null,
  "max_epss": 0.99999,
  "last_updated": "2026-07-27T17:31:39.972554Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}

safe version

Caddy 2.11.4 is past the 2.7.5 Rapid Reset fix line used in the vulnerable example response.

bash

curl "https://api.attestd.io/v1/check?product=caddy&version=2.11.4" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

Caddy's NVD history mixes early TLS authentication flaws, a disputed rewrite DoS on 2.5.1, and shared HTTP/2 protocol issues that also hit other servers. Critical product-specific RCE entries are uncommon on the current 2.x line.

CVE	Description	Affects	CVSS
`CVE-2018-21246`	TLS client authentication mishandling allows authentication bypass without StrictHostMatching.	< 0.10.13	9.8
`CVE-2023-44487`KEV	HTTP/2 Rapid Reset exhausts server resources via rapid stream cancellation.	HTTP/2 stacks	7.5
`CVE-2022-34037`	Out-of-bounds read in HTTP rewrite DoSes the process via a crafted URI. NVD marks this CVE as disputed.	2.5.1	7.5

KEV = CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed.

data sources

Single CPE namespace

NVD lists Caddy under one product identifier for the current project:

cpe:2.3:a:caddyserver:caddyCaddy 2.x and later advisories

Attestd maps the caddy product slug to this CPE and matches caller versions against NVD ranges for that namespace.

All products NGINX Traefik Quickstart