Debian Patches

Status for caddy/2.6.2-12+deb13u1

Patch Description Author Forwarded Bugs Origin Last update
0005-Remove-tracing-module-to-reduce-dependencies.patch Remove tracing module to reduce dependencies Peymaneh <peymaneh@posteo.net> not-needed 2022-11-24
0006-postinst.sh-Do-not-call-chown-recursively.patch postinst.sh: Do not call chown recursively Peymaneh <peymaneh@posteo.net> not-needed 2022-12-17
0008-remove-dirs-on-purge.patch postinst/postrm: do not leave directories on purge Peymaneh <peymaneh@posteo.net> no 2022-12-23
0004-Add-short-description-for-caddy-command.patch Add short description for caddy command Peymaneh <peymaneh@posteo.net> no 2023-01-02
0005-Remove-obsolote-subcommands.patch Remove obsolote subcommands Peymaneh <peymaneh@posteo.net> not-needed 2023-01-02
0006-Add-variable-for-reproducible-manpage-time-stamps.patch Add variable for reproducible manpage time stamps Peymaneh <peymaneh@posteo.net> no 2023-01-14
0007-quic-go-0.50.0.patch quic-go 0.46.0 Shengjing Zhu <zhsj@debian.org> no 2023-08-23
CVE-2026-27585.patch fileserver: Replace \ with \\ in file matcher paths
The test hunk of this commit is omitted: it relies on a testdata fixture whose
file name contains a backslash, which cannot be carried in a Debian source
package. Upstream removed that fixture again in cb436f0a.		 Matthew Holt <mholt@users.noreply.github.com> yes debian upstream upstream, https://github.com/caddyserver/caddy/commit/a2825c5dd952769f139a16448dc1ca1be61b6058 2026-02-19
CVE-2026-27587-1.patch caddyhttp: Lowercase comparison when matching with escape sequence
The test hunk of this commit is omitted: it does not apply to 2.6.2's test table
without fuzz.		 Matthew Holt <mholt@users.noreply.github.com> yes debian upstream upstream, https://github.com/caddyserver/caddy/commit/bd374ca9d72e296c9361aee76924b6540f22f0c0 2026-02-09
CVE-2026-27587-2.patch Merge commit from fork
Necessary as otherwise the early-bail in `until =
strings.IndexByte(remaining, nextCh) ... if until == -1` can cause a
case-insensitive mismatch


The test hunk of this commit is omitted: it does not apply to 2.6.2's test table
without fuzz.		 Matt Holt <mholt@users.noreply.github.com> yes debian upstream upstream, https://github.com/caddyserver/caddy/commit/a1081194bfae4e0d8c227ec44aecb95eded55d1e 2026-02-20
CVE-2026-27588.patch caddyhttp: normalize host matcher entries for the large-list fast path MatchHost is documented and implemented as case-insensitive: the linear
matching loop uses strings.EqualFold(). For lists of more than 100 entries,
however, Match() takes a binary-search fast path that compares byte-exactly
("m[pos] == reqHost"), while Provision() only lowercased entries into its
duplicate-detection map and never wrote the normalized value back into the
slice. After a fast-path miss the linear loop immediately breaks at the first
non-fuzzy entry, so exact hosts are never re-checked case-insensitively.
.
An attacker can therefore bypass host-gated routes, and any access controls
attached to them, merely by changing the case of the Host header.
.
Normalize non-fuzzy (non-wildcard, non-placeholder) entries in Provision() and
fold the request host in the fast path, matching upstream. Wildcard and
placeholder entries are left untouched.		 not-needed backport, https://github.com/caddyserver/caddy/commit/eec32a0bb5a11651c6a7b04ce82dc50610f2b27e 2026-08-10
CVE-2026-27589-1.patch admin: Reject requests with Sec-Fetch-Mode headers
And buggy Origin: null headers.

Resolves a low-risk security report by @1seal.		 Matthew Holt <mholt@users.noreply.github.com> yes debian upstream upstream, https://github.com/caddyserver/caddy/commit/42ca010e9d8da35e91edd69e724d3736678b5620 2026-02-05
CVE-2026-27589-2.patch admin: Enforce origin implicitly based on request headers Matthew Holt <mholt@users.noreply.github.com> yes debian upstream upstream, https://github.com/caddyserver/caddy/commit/72ac479f5d0472425fe150c4aacd03d1030b0077 2026-02-11
CVE-2026-27589-3.patch Add missing return to` handleError` in admin server
Thanks to @Wernerina's LLM for finding this bug		 Matthew Holt <mholt@users.noreply.github.com> yes debian upstream upstream, https://github.com/caddyserver/caddy/commit/c35ba5588d2ccf85bb3767811a65eac819dd277b 2026-03-25
CVE-2026-27589-4.patch admin: fix origin comparison

The test hunk of this commit is omitted: it extends admin_security_test.go,
which does not exist in 2.6.2.		 Mohammed Al Sahaf <msaa1990@gmail.com> yes debian upstream upstream, https://github.com/caddyserver/caddy/commit/1661cfd901ed876d62b41259f0d2eddfe255bb24 2026-06-09
CVE-2026-27590.patch fastcgi: split the request path on byte offsets, not folded offsets splitPos() located the split path (e.g. ".php") in strings.ToLower(path) but
returned that index for slicing the *original* path. Unicode case folding can
change a string's length in bytes, so the returned offset could point at an
unrelated position of the original path, yielding a SCRIPT_NAME /
SCRIPT_FILENAME and PATH_INFO that do not correspond to the requested URI.
Where an attacker can influence file contents (upload features and the like),
a request containing ".php" can thereby be made to execute a different
on-disk file, up to remote code execution depending on the deployment.
.
Search the bytes of the path directly using ASCII-only case-insensitive
comparison, so the returned index is always a valid offset into the path.
Bytes >= utf8.RuneSelf are only ever compared for equality, so Unicode
equivalences (fullwidth, circled or mathematical letters folding onto ASCII)
can never make an uploaded file be detected as a script either.
.
This combines upstream 7c28c0c0 with the follow-up hardening in fb324331
(CVE-2026-45135), which replaced the golang.org/x/text/search fallback that
7c28c0c0 had introduced. Taking the final upstream state directly avoids
pulling a new module dependency into the package and avoids introducing the
CVE-2026-45135 flaw in the first place.
.
Deliberate deviation from upstream: upstream's Provision() change, which
rejects non-ASCII split_path values outright with a new ErrInvalidSplitPath,
is not backported. On a stable release that would turn a previously accepted
configuration into a hard startup failure; both operands are ASCII-folded at
comparison time instead, which is equivalent for all ASCII split paths.		 not-needed backport, https://github.com/caddyserver/caddy/commit/7c28c0c07ac70a8960a166c7126150a408ba7464 2026-08-10
CVE-2026-45692.patch admin: agree on config paths between authorization and traversal The remote admin API's authorization layer and the /config traversal layer did
not agree on which object a path refers to. enforceAccessControls() authorized
request paths with a plain strings.HasPrefix() against the configured
access_control paths, so "/config/.../srv" also authorized "/config/.../srv0";
and unsyncedConfigAccess() parsed array indices with strconv.Atoi(), which
accepts non-canonical spellings such as "01", "+1" and "-0". A path that was
authorized for one config object could therefore resolve to a different config
object during traversal.
.
Require a path-segment boundary in the access check (upstream 2d332714) and
reject non-canonical array indices (upstream 18ab0f95).		 not-needed debian upstream backport, https://github.com/caddyserver/caddy/commit/2d332714829aa3b530424d47ae092074b09a2268 2026-08-10
CVE-2026-52845.patch caddyhttp: drop request headers whose names contain an underscore forward_auth's copy_headers deletes the exact client-supplied identity header
before copying the trusted value from the auth gateway. The FastCGI transport,
however, normalizes header names into CGI variables by replacing '-' with '_',
so a client-supplied "Remote_User" survives the delete step for "Remote-User"
and then collides with it in env["HTTP_REMOTE_USER"], where the winner is
decided by Go's randomized map iteration order. A remote client can thereby
inject or override identity and group headers trusted by PHP/FastCGI
applications behind Caddy.		 not-needed backport, https://github.com/caddyserver/caddy/commit/3eb8e48ff052e1ad16d88c683672c306d2077a11 2026-08-10
CVE-2026-52846.patch templates: Patch for GHSA-vcc4-2c75-vc9v (#7785)
* Patch GHSA-vcc4-2c75-vc9v in stripHTML


The previous false-start approach allowed XSS bypass via inputs like <<>img src=x onerror=alert(1)> and failed on stacked angle brackets.

Replace the tagStart/inTag state machine with a depth counter that mirrors PHP strip_tags behaviour: each '<' increments depth, each '>' decrements it, and text is only emitted at depth zero. Quoted attribute values (both single and double) are tracked so '>' inside href values does not prematurely close a tag.


* Update tplcontext_test.go		 JM Sanchez <77505889+jmrcsnchz@users.noreply.github.com> no 2026-06-02

All known versions for source package 'caddy'

Links