Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
coredns/caddy
master @ 32b690f
3
Fixes
0
CVEs
MEDIUM
Peak severity
Highlights
Auth Bypass: 2 prior fixes. Scrutinize any change in this area.
caddyhttp/proxy: most-fixed (1 issue). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Inadequate path canonicalization in the proxy middleware allowed restricted subpaths to bypass security checks. This occurred because trailing slashes were stripped or normalized in inconsistent ways during path matching. Future routing updates must rigorously sanitize and canonicalize all inbound paths before evaluating access controls.
Auth Bypass: On-demand TLS configuration logic permitted unauthorized certificate generation. When fallback or random TLS configurations were selected during TLS-ALPN challenges, the absence of explicit disabling mechanisms allowed arbitrary hostnames to trigger on-demand certificates. Guarding the challenge configuration selection is vital to restrict automated certificate issuance.
Denial of Service: A goroutine leak existed in the TLS certificate storage cleaning routine during server shutdown or restart cycles. When long-running goroutines fail to listen to termination signals, repeated reloads can exhaust system memory and CPU, leading to denial of service.