-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 24 Oct 2026 12:03:02 +0200 Source: caddy Architecture: source Version: 2.6.2-5+deb12u1 Distribution: bookworm-security Urgency: high Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org> Changed-By: Thorsten Alteholz <debian@alteholz.de> Changes: caddy (2.6.2-5+deb12u1) bookworm-security; urgency=high . * Non-maintainer upload by the LTS Team. * CVE-2026-77281 disclosure contents of readable files * CVE-2026-27585 due to not anitizing backslashes path related security protections migth be bypassed * CVE-2026-27587 bypass path-based routing and access controls by changing case of letters in the request path * CVE-2026-27588 bypass path-based routing and access controls by changing case of letters in the 'Host' header * CVE-2026-27589 changing configuration by cross-origin requests * CVE-2026-27590 unintended PHP execution of non-.php files * CVE-2026-45692 bypass authorization settings due to bad parsing of paths * CVE-2026-52845 remote override of headers The fix for CVE-2026-52845 follows upstream in dropping every request header whose name contains an underscore, for all servers and without an opt-out. Deployments which pass such headers through Caddy, for instance X_Api_Key or gRPC custom metadata keys containing underscores, need to switch to the hyphenated spelling. * CVE-2026-52846 client side XSS Checksums-Sha1: c1ed8355d66d6d1645674ec7ddc507460bf9b8d3 3593 caddy_2.6.2-5+deb12u1.dsc ac41889b3bbccb7b9530275308e9cbb52c5bfe6a 22770 caddy_2.6.2.orig-dist.tar.gz 51f5c18075933a255a773a380f7f57e7350730cc 541579 caddy_2.6.2.orig.tar.gz 4c30170ab2d748ae4d9c82b8e233c9e52b077c8f 444844 caddy_2.6.2-5+deb12u1.debian.tar.xz e45f8eb5f30c9e1e670ade4e1433f1aa6fa01ce1 18173 caddy_2.6.2-5+deb12u1_amd64.buildinfo Checksums-Sha256: ebccad7fe668d580699541455c33ffd809c3b60b16f7488a274e47a82a2dc9bb 3593 caddy_2.6.2-5+deb12u1.dsc 95e86794dbe16372451acf16a049d19a85fb8341dcbaf4fc5c79c3698934726f 22770 caddy_2.6.2.orig-dist.tar.gz b6f92ee37462851e125c2c725a2a7fefa045a46478eeb4e751f24c9a827e8668 541579 caddy_2.6.2.orig.tar.gz 39797c53491397f68ea16e75f46f74279589fc36c8c967b3ec59167feb294c7a 444844 caddy_2.6.2-5+deb12u1.debian.tar.xz d5d61cd7cc6f54166d4acde6b257c9ab09e742b2a1b60e60216ce5cea7a31ffd 18173 caddy_2.6.2-5+deb12u1_amd64.buildinfo Files: b617eb551740f5c291065157d6204f93 3593 httpd optional caddy_2.6.2-5+deb12u1.dsc 4516e89eb1b6c8fbc66ec7023ba6ff18 22770 httpd optional caddy_2.6.2.orig-dist.tar.gz bd0034017a5cc30f86e1cfeda35475bf 541579 httpd optional caddy_2.6.2.orig.tar.gz ce35d45650c24cc6f83f592eab700b8a 444844 httpd optional caddy_2.6.2-5+deb12u1.debian.tar.xz fe2c093a442bc9d447d38e352777c29e 18173 httpd optional caddy_2.6.2-5+deb12u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQKnBAEBCgCRFiEEYgH7/9u94Hgi6ruWlvysDTh7WEcFAmrcln9fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYy MDFGQkZGREJCREUwNzgyMkVBQkI5Njk2RkNBQzBEMzg3QjU4NDcTHGRlYmlhbkBh bHRlaG9sei5kZQAKCRCW/KwNOHtYR1okEACu+8qaS3Ti7b/BKw/e3zD+7q0OpXgw vOkMMZxzuLJ5PTBh2VvEpN6TnleUXry4sC3/5Nl7Yz95VQDrVGpTmjb5WYAZhOhP KRXyu1kRLAIjgjlhp2GNGP9qAh3wzzF3Ptrhr8YcI6Vs/3BcKT9Girua2ZO4LGcc Mv0K4/BQIWvd+HnqN2sqMiUUbEk6lUCe5Bcu3mUgPMT6sjdJULvBGv5JC7Prt4OG wlQHtqp42fvKvUsEoSawiRDckUUwK2tbNFx6+YmnFzO+ub/rU/MWR1yG1gvzHm35 wbCULZP5xsIq5lmTNh9xxTY6LBhLu2CtxCpHe1DkYJu6nYOK3mbdWziIxe8p4Nby R1oDo4LMJ2wB9Mw8CDJ3R37uJLIv60tEoAdQdKbsQfy1rhC1ggVolKXzq8nE6fVj fsCD0ZG+44H5b5Q5biSIL4vafhq3rxPKyku2wXU1rLhkbf2yzq2jRUrUG8lwiSBZ wKC5evvNmpEEuKe4jo/ZdeojjdJVr5zf9E2JqcrmNbZFupzmltckgTVbmSJPLqPC NJCsj7xK3n4VgXBPexTpMR2e/czh31oY4fLJW7mU1tucjxHhAIq1R7GxQ+Jyh4pH fCsgN+L7/SZWmW4mRlC4ed3wE1DrXNpH+TtKsFg2UU7iAw3S7uUTHR06f0pymE5U FptgGK37Uc+lhA== =sokU -----END PGP SIGNATURE-----
