{"action":"Upgrade caddy to 2.11.4-1 or later.","affected":[{"fixed":"2.11.4-1","introduced":"0"}],"component":"caddy","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["2.11.4-1"],"id":"tcs_01M5NSR8PM2BCS6DAG1BF7V8QT","modified_at":"2026-10-24T18:00:06.810137200Z","published_at":"2026-06-23T18:18:05.400Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-52846","https://security-tracker.debian.org/tracker/CVE-2026-52846"],"severity":{"label":"medium","score":4.2},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-52846#Debian:14/caddy","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-52846"}],"summary":"Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, s"}