CVE-2026-45135High· 8.1▾ Twilight

caddy: github.com/caddyserver/caddy/v2: Caddy: Remote Code Execution via Unsafe Unicode Handling in FastCGI (CVE-2026-45135)

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score45/ 100 · Moderate

impact 44.6 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jun 23, 2026

Updated

Sep 23, 2026

CVSS

8.1

Vendor

Red Hat

Product

github.com/caddyserver/caddy/v2

CWE

CWE-1289

Depth score

45 · Moderate

EPSS

0.68% · p52

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Jul 30.

0.5% → 0.7%▲ 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 92 days

Jun 23, 2026Published
Disclosed via CSAF
Jul 30, 2026EPSS first tracked
0.5%
Aug 24, 2026EPSS peak
0.5% → 0.7%
Sep 23, 2026Record revised
Last analysed / modified upstream

Red Hat CWE-1289 #csaf #vex #red-hat #osv #go

Affected

github.com/caddyserver/caddy/v2 >= 2.7.0, < 2.11.3

Patched in

github.com/caddyserver/caddy/v2 2.11.3

Full technical detail▾

Overview

A flaw was found in Caddy. This vulnerability stems from unsafe handling of Unicode characters within the FastCGI component, specifically when processing request paths containing non-ASCII bytes. An attacker capable of placing content into files served via FastCGI can exploit this by crafting a malicious URL. This can mislead Caddy into executing non-script files as scripts, potentially leading to remote code execution.

Vendor advisories

Red Hat VEX · Important · updated 2026-09-23 · vex

caddy: github.com/caddyserver/caddy/v2: Caddy: Remote Code Execution via Unsafe Unicode Handling in FastCGI — rated Important by Red Hat. Released 2026-06-23, updated 2026-09-23.

Not affected:

Red Hat Hardened Images

Remediation

Refer to the advisory for fix availability.

Package advisory (CVE-2026-45135)

Affected packages:

github.com/caddyserver/caddy/v2 >= 2.7.0, < 2.11.3

Patched in:

github.com/caddyserver/caddy/v2 2.11.3

Source: https://osv.dev/vulnerability/GHSA-m675-2p33-xv9g

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#osv#go

← Back to feed