high CVSS 8.1 EPSS 0.68%

CVE-2026-45135·Caddy vulnerability

Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non-.php (or other configured split_path extension) file as a script. In any deployment where the attacker can place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This vulnerability is fixed in 2.11.3.

Severity
high
Software
Caddy
Fixed in
2.11.3
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.68% — higher than 51% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-45135 scores 8.1 on CVSS, so a successful attack would be serious — but at 0.68%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

From: 2.7.0

Until: 2.11.3

Fixed in: 2.11.3

How to fix this CVE

Upgrade Caddy to version 2.11.3 or later immediately to patch a critical FastCGI path handling vulnerability. The vulnerability allows attackers to bypass file extension checks and execute arbitrary code on systems where user-controlled files are served through FastCGI. Organizations running Caddy 2.7.0 through 2.11.2 should prioritize this update, especially if they host user uploads or dynamic content via FastCGI backends.

sudo dnf update caddy

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET.*(?:[\x80-\xFF]+.*\.(php|jsp|asp|py|pl)).*HTTP|URL.*path.*containing.*non-ASCII.*bytes.*split_path.*bypass

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Configure WAF to block HTTP requests with non-ASCII characters in the URL path when targeting FastCGI backends: ModSecurity rule to reject requests matching `^(?:[\x00-\x08\x0B\x0C\x0E-\x1F\x7F-\xFF])+` in URI. Implement strict file upload scanning to prevent placement of executable files with misleading extensions.

How to check if you are affected

  1. Check installed Caddy version: caddy version
  2. Identify FastCGI backends in your Caddy config: grep -r 'fastcgi' /etc/caddy/ to locate all reverse_proxy directives with FastCGI transport
  3. Review Caddy logs for suspicious requests with non-ASCII characters in paths: grep -i 'non-ascii\|invalid.*path' /var/log/caddy/access.log
  4. Verify successful remediation: caddy version | grep -E '2\.(11\.[3-9]|12|[2-9][0-9])' confirms version 2.11.3 or higher is running

FAQ

What is CVE-2026-45135?

This vulnerability affects Caddy's FastCGI module, where path-based script detection logic incorrectly processes URLs containing non-ASCII bytes. Attackers can craft malicious paths to bypass file extension validation and trick the server into executing non-script files as PHP or other FastCGI applications, leading to remote code execution.

Is CVE-2026-45135 being actively exploited?

No, this vulnerability is not currently listed in the CISA KEV catalog and there are no publicly disclosed exploits available. However, the high CVSS score (8.1) and RCE potential mean prompt patching is essential for defense-in-depth.

What versions of Caddy are affected by CVE-2026-45135?

Caddy versions 2.7.0 through 2.11.2 are vulnerable. The fix was released in version 2.11.3.

How do I check if my server is vulnerable to CVE-2026-45135?

Run `caddy version` and compare the output against 2.11.3. If your version is between 2.7.0 and 2.11.2 inclusive, and you use FastCGI with `reverse_proxy` directives, your deployment is vulnerable.

Does Defensia detect CVE-2026-45135?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Caddy is installed on a monitored server, CVE-2026-45135 will appear in your dashboard with remediation steps.

Related Caddy CVEs

CVE-2026-27590CVSS 9.8Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because `strings.ToLower()` can change UTF-8 byte length for some characters. As a result, Caddy can derive an incorrect `SCRIPT_NAME`/`SCRIPT_FILENAME` and `PATH_INFO`, potentially causing a request that contains `.php` to execute a different on-disk file than intended (path confusion). In setups where an attacker can control file contents (e.g., upload features), this can lead to unintended PHP execution of non-.php files (potential RCE depending on deployment). Version 2.11.1 fixes the issue.
CVE-2026-52845CVSS 8.1Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.
CVE-2026-52844CVSS 7.5Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.
CVE-2026-45692CVSS 5.4Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different config object during traversal. This happens because the authorization layer uses string prefix matching and the /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed in 2.11.3.
CVE-2026-52846CVSS 4.2Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. This vulnerability is fixed in 2.11.4.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-45135. Free for 1 server.

Get started free