{"action":"Upgrade caddy to 2.6.2-12+deb13u1 or later.","affected":[{"fixed":"2.6.2-12+deb13u1","introduced":"0"}],"component":"caddy","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["2.6.2-12+deb13u1"],"id":"tcs_01M5NSR8K64KGYNBJC52X6TVF0","modified_at":"2026-10-24T18:00:06.810137200Z","published_at":"2026-06-23T18:18:05.400Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-52846","https://security-tracker.debian.org/tracker/CVE-2026-52846"],"severity":{"label":"medium","score":4.2},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-52846#Debian:13/caddy","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-52846"}],"summary":"Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, s"}