Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

caddyserver/caddy

              master @ f450068
            

Fixes

CVEs

CRITICAL

Peak severity

39.5%

Coverage

Highlights

Auth Bypass: 11 prior fixes. Scrutinize any change in this area.

modules/caddyhttp/rewrite/rewrite.go: most-fixed (6 issues). Treat as high-risk during review.

22 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Authentication Bypass: Silent configuration failures in mTLS trust anchors and verification bypasses during TLS session resumption allow unauthorized clients to connect without valid credentials. Failure to verify leaf certificates properly or falling back to system trust stores undermines custom private CA boundaries.

Path Traversal: Flaws in prefix trimming, URL path recomputation (leaving RawPath unmodified), and double-expansion of placeholders allow attackers to forge paths that bypass access lists or route restrictions. Sanitization checks are easily bypassed if executed before raw paths are fully normalized.

Auth Bypass: Path matchers and host routing filters are susceptible to bypasses via casing differences (mixed-case headers), trailing characters (dots and spaces on Windows), or incomplete TLS handshakes allowing 0-RTT IP spoofing. Case-insensitive matching and canonicalization must be explicitly enforced.