CVE-2026-52846

Go/github.com/caddyserver/caddy/v2 CVE-2026-52846: medium 4.2

Caddy: stripHTML template function bypass

Action: Upgrade github.com/caddyserver/caddy/v2 to 2.11.4 or later.

go get github.com/caddyserver/caddy/v2@v2.11.4

Affected

Fixed versions

Sources

• osv: GHSA-vcc4-2c75-vc9v
• https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9v
• https://github.com/caddyserver/caddy

CVE-2026-52846 · published 2026-06-16T21:28:55Z · modified 2026-07-24T19:11:47.063874212Z · JSON

Go/github.com/caddyserver/caddy CVE-2026-52846: medium 4.2

Caddy: stripHTML template function bypass

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-vcc4-2c75-vc9v#Go/github.com/caddyserver/caddy
• https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9v
• https://github.com/caddyserver/caddy

CVE-2026-52846 · published 2026-06-16T21:28:55Z · modified 2026-07-24T19:11:47.063874212Z · JSON

Go/github.com/caddyserver/caddy/v2 CVE-2026-52846: unknown

Caddy: stripHTML template function bypass in github.com/caddyserver/caddy

Action: Upgrade github.com/caddyserver/caddy/v2 to 2.11.4 or later.

go get github.com/caddyserver/caddy/v2@v2.11.4

Affected

Fixed versions

Sources

• osv: GO-2026-5660
• https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9v

CVE-2026-52846 · published 2026-07-24T18:35:55Z · modified 2026-07-24T19:00:25.441370322Z · JSON