Back Linuxsecurity

Fedora 43 Caddy Important Security Update 22 CVEs Advisory 2026

Linuxsecurity •LinuxSecurity Advisories • July 2, 2026

Security update resolving 22 CVEs across both caddy itself and its vendored libraries.

* Tue Jun 23 2026 Carl George - 2.10.2-9 - Port to new golang packaging guidelines - Backport upstream fix for CVE-2026-27585 - Backport upstream fix for CVE-2026-27586 - Backport upstream fix for CVE-2026-27587 - Backport upstream fix for CVE-2026-27588 - Backport upstream fix for CVE-2026-27589 - Backport upstream fix for CVE-2026-27590 - Backport upstream fix for CVE-2026-30851 - Backport upstream fix for CVE-2026-30852 - Update vendored github.com/quic-go/quic-go to v0.57.0 for CVE-2025-64702 - Update vendored golang.org/x/crypto to v0.52.0 for CVE-2025-47913, CVE-2026-39828, CVE-2026-39829, and CVE-2026-39830 - Update vendored github.com/smallstep/certificates to v0.30.0 for CVE-2025-44005 and CVE-2026-40097 - Update vendored github.com/go-chi/chi/v5 to v5.2.5 for CVE-2025-69725 - Update vendored github.com/yuin/goldmark/renderer/html to v1.7.17 for CVE-2026-5160 * Mon Feb 2 2026 Maxwell G - 2.10.2-5 - Rebuild for * Fri Jan 16 2026 Fedora Release Engineering - 2.10.2-4 - Rebuilt for * Fri Jan 16 2026 Fedora Release Engineering - 2.10.2-3 - Rebuilt for * Fri Oct 10 2025 Alejandro Sáez - 2.10.2-2 - rebuild

[ 1 ] Bug #2488094 - CVE-2026-30851 caddy: Caddy: Privilege escalation via identity injection due to unstripped client headers [fedora-all] [ 2 ] Bug #2488095 - CVE-2026-30852 caddy: Caddy: Information disclosure via double-expansion of user-controlled input [fedora-all] [ 3 ] Bug #2488141 - CVE-2026-40097 caddy: Step CA: Denial of Service via crafted attestation key certificate [fedora-all] [ 4 ] Bug #2488502 - CVE-2026-27585 caddy: Caddy: Path security bypass due to unsanitized backslashes [fedora-all] [ 5 ] Bug #2488503 - CVE-2026-27586 caddy: Caddy: Authentication bypass via mTLS client certificate validation failure [fedora-all] [ 6 ] Bug #2488514 - CVE-2026-27587 caddy: ...

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-3dc324bd9a' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora Caddy Security Updates Address Multiple CVEs On June 23, 2026, Fedora released critical security updates for Caddy, addressing 22 CVEs in Fedora 43 and 17 CVEs in Fedora 44. The vulnerabilities include privilege escalation, information disclosure, and denial of service. Key CVEs include CVE-2026-27585, CVE-2026-30851, and CVE-2026-40097, which affect both Caddy and its vendored libraries. The updates were backported from upstream fixes and involve updates to various dependencies. Users are advised to apply the updates using the 'dnf' package manager. The vulnerabilities could lead to significant security risks if left unpatched. The updates are crucial for maintaining the integrity and security of systems running Fedora with Caddy. 2 sources 74

Fedora 43 Caddy Important Security Update 22 CVEs Advisory 2026

The full story

Extracted Entities

Companies (1)

CVEs (17)

CWE Weaknesses (5)

Domains (1)

Tools (1)