How many CVEs have a located fix in caddyserver/caddy?

13 published CVEs have a fix traced to functions in caddyserver/caddy, touching 80 functions across 36 files.

Which function in caddyserver/caddy has been patched by the most CVEs?

Rewrite in modules/caddyhttp/rewrite/rewrite.go has been changed by 2 CVE fixes, from 2022 to 2026.

How large is a typical CVE fix in caddyserver/caddy?

The median fix changes 18 lines. 54% of fixes change 20 lines or fewer, and 46% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

go

#457 of 500 repositories

caddyserver/caddy

Name: caddyserver/caddy: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix September 17, 2026

13

CVE fixes located

Published CVEs

80

Functions patched

Distinct function sites

36

Files patched

Distinct source files

2018–2026

Years covered

By CVE publication date

Overview

13 published CVEs have a fix traced to functions in caddyserver/caddy, the earliest published in 2018. Those fixes changed 80 distinct functions across 36 files, in 140 patch hunks.

Among the 500 repositories tracked here, caddyserver/caddy ranks #457 by the number of CVEs with a located fix.

Most patched functions

Functions in caddyserver/caddy changed by the most CVE fixes.

Most patched files

Files in caddyserver/caddy changed by the most CVE fixes.

1modules/caddyhttp/matchers.go3 CVEs · 4 functions
2caddy.go2 CVEs · 8 functions
3caddytls/config.go2 CVEs · 6 functions
4caddyhttp/httpserver/plugin.go2 CVEs · 3 functions
5caddyhttp/httpserver/server.go2 CVEs · 2 functions
6admin.go2 CVEs · 1 functions
7modules/caddyhttp/rewrite/rewrite.go2 CVEs · 1 functions
8sigtrap_posix.go2 CVEs · 1 functions
9caddytls/certificates.go1 CVEs · 7 functions
10caddytls/handshake.go1 CVEs · 6 functions

Fix size

How much code a CVE fix in caddyserver/caddy changes, with backports counted once.

18

Median lines changed

Added plus removed, per CVE

54%

Fixes of 20 lines or fewer

Share of CVE fixes

46%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in caddyserver/caddy, and the functions each fix changed.

Caddy: rewrite placeholder re-expansion
CVE-2026-77281Rewrite
Medium · CVSS 6.5
EPSS 0.5%2026-09-17
Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation
CVE-2026-30851parseCaddyfile
High · CVSS 8.8
EPSS 0.4%2026-03-07
Caddy: vars_regexp double-expands user input, leaking env vars and files
CVE-2026-30852Match
Medium · CVSS 5.5
EPSS 0.5%2026-03-07
Caddy vulnerable to cross-origin config application via local admin API /load (caddy)
CVE-2026-27589reloadFromSourceFunc trapSignalsPosix loadConfigWithLogger
Medium · CVSS 6.9
EPSS 0.2%2026-02-24
Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass
CVE-2026-27588Provision MatchWithError
High · CVSS 7.7
EPSS 0.6%2026-02-24
Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass
CVE-2026-27587matchPatternWithEscapeSequence
High · CVSS 7.7
EPSS 0.6%2026-02-24
Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed
CVE-2026-27586provision
High · CVSS 8.8
EPSS 0.4%2026-02-24
HTTP/2 Stream Cancellation Attack
CISA KEV
CVE-2023-44487sortRoutes Setup
Medium · CVSS 6.9
EPSS 100.0%2023-10-10
Open Redirect in Caddy
CVE-2022-28923directoryListing SanitizedPathJoin
Medium · CVSS 6.1
EPSS 1.4%2023-02-06
Withdrawn Advisory: Out-of-bounds Read can lead to client side denial of service
CVE-2022-34037Rewrite
High · CVSS 7.5
EPSS 1.2%2022-07-22
Open redirect in caddy
CVE-2022-29718Match
Medium · CVSS 6.1
EPSS 1.1%2022-06-02
Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication
CVE-2018-21246MakeServers serveHTTP SiteConfig
Critical · CVSS 9.8
EPSS 2.7%2020-06-15

Get an alert for each new caddyserver/caddy CVE, with the patched functions and AI-written analysis.

Monitor caddy CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

apache/kylin13 CVEs apache/superset13 CVEs bagisto/bagisto13 CVEs better-auth/better-auth13 CVEs cerebrate-project/cerebrate13 CVEs CoreWCF/CoreWCF13 CVEs craftcms/commerce13 CVEs debian/bind913 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in caddyserver/caddy.

How many CVEs have a located fix in caddyserver/caddy?: 13 published CVEs have a fix traced to functions in caddyserver/caddy, touching 80 functions across 36 files.
Which function in caddyserver/caddy has been patched by the most CVEs?: Rewrite in modules/caddyhttp/rewrite/rewrite.go has been changed by 2 CVE fixes, from 2022 to 2026.
How large is a typical CVE fix in caddyserver/caddy?: The median fix changes 18 lines. 54% of fixes change 20 lines or fewer, and 46% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track caddyserver/caddy CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing