StackRadar

CVE-2026-77281

Medium

Advisory

Published 18 Sept 2026In the index since 19 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.004
30th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
29
of 17,813 indexed, latest versions
Container images
25
deployed by those charts
Fix available
1 of 1
affected package

Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass

Carried by container images the latest versions of 29 of 17,813 indexed charts deploy, on 25 images.

Affected packageAffected versionsFixed inImages
github.com/caddyserver/caddy/v2golangv2.2.0, v2.4.0, v2.4.2, v2.4.5+13 more2.11.425
OSV records
GHSA-j8px-rmrx-76h9

Charts affected

29 by stars
ChartLatestAffected imagesRadar Score
baserowbaserow-chartVerified publisher1.0.561 of 6See more

baserow baserow-chart 1.0.56

1 of the 6 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
caddy/ingress:v0.2.118d1366fc0e9
github.com/caddyserver/caddy/v2@v2.7.5
2.11.4

Open the chart page →

17,791
caddy-ingress-controllercaddy-ingress1.3.01 of 1See more

caddy-ingress-controller caddy-ingress 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
caddy/ingress:v0.2.118d1366fc0e9
github.com/caddyserver/caddy/v2@v2.7.5
2.11.4

Open the chart page →

1,901
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
github.com/caddyserver/caddy/v2@v2.7.6
2.11.4

Open the chart page →

17,183
kubeviouskubevious1.2.21 of 7See more

kubevious kubevious 1.2.2

1 of the 7 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
kubevious/ui:1.2.16233e84bdd59
github.com/caddyserver/caddy/v2@v2.6.1
2.11.4

Open the chart page →

14,253
wordpress-hardenedriotkit-org2.0.01 of 2See more

wordpress-hardened riotkit-org 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
ghcr.io/riotkit-org/waf-proxy:snapshot683656fdace2
github.com/caddyserver/caddy/v2@v2.5.1
2.11.4

Open the chart page →

6,617
maintenancecodewithemadVerified publisher0.1.61 of 1See more

maintenance codewithemad 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
library/caddy:2.9-alpineb4e3952384eb
github.com/caddyserver/caddy/v2@v2.9.1
2.11.4

Open the chart page →

1,494
gboxgboxVerified publisher1.0.51 of 2See more

gbox gbox 1.0.5

1 of the 2 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
gboxproxy/gbox:v1.0.63a9f4a711d5c
github.com/caddyserver/caddy/v2@v2.5.0
2.11.4

Open the chart page →

2,539
headscale-uiheadscale-uiVerified publisher0.2.91 of 1See more

headscale-ui headscale-ui 0.2.9

1 of the 1 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
ghcr.io/gurucomputing/headscale-ui:2026.03.17015f5ba04bcb
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4

Open the chart page →

1,502
kubebrowsekubebrowse1.7.01 of 5See more

kubebrowse kubebrowse 1.7.0

1 of the 5 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
ghcr.io/browsersec/kubebrowse-frontend:chore-improve-backbd6bea5e487c
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4

Open the chart page →

2,933
wordpress-helmwordpress-helm0.2.91 of 4See more

wordpress-helm wordpress-helm 0.2.9

1 of the 4 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
aapjeisbaas/wp-frankenphp:v0.2.26b261abc7fb0
github.com/caddyserver/caddy/v2@v2.11.3
2.11.4

Open the chart page →

8,503
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
caddy/ingress:v0.2.118d1366fc0e9
github.com/caddyserver/caddy/v2@v2.7.5
2.11.4

Open the chart page →

10,308
caddycaddyVerified publisher0.0.41 of 1See more

caddy caddy 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
library/caddy:2.11.2-alpine834468128c76
github.com/caddyserver/caddy/v2@v2.11.2
2.11.4

Open the chart page →

1,706
mercurecloudnativeapp1.0.21 of 1See more

mercure cloudnativeapp 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
dunglas/mercure:v0916834e49961
github.com/caddyserver/caddy/v2@v2.11.3
2.11.4

Open the chart page →

1,127
parrot-mirroremmas-chartsVerified publisher1.0.01 of 1See more

parrot-mirror emmas-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
registry.gitlab.com/parrotsec/project/parrot-mirror-docker:mainf91b602ca572
github.com/caddyserver/caddy/v2@v2.7.4
2.11.4

Open the chart page →

2,261
supportpalevilgn0me0.1.61 of 1See more

supportpal evilgn0me 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
github.com/caddyserver/caddy/v2@v2.5.1
2.11.4

Open the chart page →

21,013
searxgeek-cookbookVerified publisher5.6.21 of 4See more

searx geek-cookbook 5.6.2

1 of the 4 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
library/caddy:2.2.0-alpine7367adca165f
github.com/caddyserver/caddy/v2@v2.2.0
2.11.4

Open the chart page →

7,507
vikunjageek-cookbookVerified publisher6.2.01 of 4See more

vikunja geek-cookbook 6.2.0

1 of the 4 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
library/caddy:2.4.2-alpinefbc51bcf1ab0
github.com/caddyserver/caddy/v2@v2.4.2
2.11.4

Open the chart page →

6,905
castopodhelmforgeVerified publisher1.2.71 of 3See more

castopod helmforge 1.2.7

1 of the 3 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
castopod/castopod:1.15.54e4f0440520f
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4

Open the chart page →

9,615
discount-bandithelmforgeVerified publisher2.0.81 of 3See more

discount-bandit helmforge 2.0.8

1 of the 3 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
cybrarist/discount-bandit:v4.0.4e9e2447ac666
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4

Open the chart page →

30,595
pimcorehelmforgeVerified publisher2.0.11 of 6See more

pimcore helmforge 2.0.1

1 of the 6 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
dunglas/mercure:v0.24.2916834e49961
github.com/caddyserver/caddy/v2@v2.11.3
2.11.4

Open the chart page →

3,258
ryothelmforgeVerified publisher1.0.01 of 2See more

ryot helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
github.com/caddyserver/caddy/v2@v2.9.1
2.11.4

Open the chart page →

6,170
op-scim-bridgelifen1.0.31 of 2See more

op-scim-bridge lifen 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
1password/scim:v2.3.129d0c6cb67eb
github.com/caddyserver/caddy/v2@v2.4.0
2.11.4

Open the chart page →

2,788
op-scim-bridgelifen-chartsVerified publisher1.0.31 of 2See more

op-scim-bridge lifen-charts 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
1password/scim:v2.3.129d0c6cb67eb
github.com/caddyserver/caddy/v2@v2.4.0
2.11.4

Open the chart page →

2,788
otlp-gatewayloafoe0.0.21 of 2See more

otlp-gateway loafoe 0.0.2

1 of the 2 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
ghcr.io/loafoe/caddy-token:v0.3.0528f2174fa2f
github.com/caddyserver/caddy/v2@v2.8.4
2.11.4

Open the chart page →

2,180
solgateloafoe0.0.121 of 1See more

solgate loafoe 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
ghcr.io/loafoe/solgate:v0.0.12b3256cbc7b68
github.com/caddyserver/caddy/v2@v2.7.4
2.11.4

Open the chart page →

2,126
novosgamarcusrepo0.1.11 of 2See more

novosga marcusrepo 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
novosga/novosga:latest34b9acbe6e51
github.com/caddyserver/caddy/v2@v2.11.2
2.11.4

Open the chart page →

3,739
gitlab-proxyopslevelVerified publisher0.0.81 of 1See more

gitlab-proxy opslevel 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
library/caddy:2.660fb54d36b4b
github.com/caddyserver/caddy/v2@v2.6.4
2.11.4

Open the chart page →

1,892
caddysagikazarmarkVerified publisher0.0.141 of 1See more

caddy sagikazarmark 0.0.14

1 of the 1 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
library/caddy:2.4.5874405536b3e
github.com/caddyserver/caddy/v2@v2.4.5
2.11.4

Open the chart page →

2,979
tfy-cloudflaredtruefoundryVerified publisher0.6.01 of 2See more

tfy-cloudflared truefoundry 0.6.0

1 of the 2 container images this version deploys carry CVE-2026-77281.

Container imageDigestPackageFixed in
public.ecr.aws/docker/library/caddy:2.6.387cbd356af2e
github.com/caddyserver/caddy/v2@v2.6.3
2.11.4

Open the chart page →

2,035

Container images carrying it

25 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
caddy/ingress:v0.2.118d1366fc0e9
github.com/caddyserver/caddy/v2@v2.7.5
2.11.4
3
1password/scim:v2.3.129d0c6cb67eb
github.com/caddyserver/caddy/v2@v2.4.0
2.11.4
2
dunglas/mercure:v0:v0.24.2916834e49961
github.com/caddyserver/caddy/v2@v2.11.3
2.11.4
2
aapjeisbaas/wp-frankenphp:v0.2.26b261abc7fb0
github.com/caddyserver/caddy/v2@v2.11.3
2.11.4
1
baserow/baserow:1.30.1df0c42eb67e8
github.com/caddyserver/caddy/v2@v2.7.6
2.11.4
1
castopod/castopod:1.15.54e4f0440520f
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4
1
cybrarist/discount-bandit:v4.0.4e9e2447ac666
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4
1
gboxproxy/gbox:v1.0.63a9f4a711d5c
github.com/caddyserver/caddy/v2@v2.5.0
2.11.4
1
kubevious/ui:1.2.16233e84bdd59
github.com/caddyserver/caddy/v2@v2.6.1
2.11.4
1
library/caddy:2.660fb54d36b4b
github.com/caddyserver/caddy/v2@v2.6.4
2.11.4
1
library/caddy:2.2.0-alpine7367adca165f
github.com/caddyserver/caddy/v2@v2.2.0
2.11.4
1
library/caddy:2.11.2-alpine834468128c76
github.com/caddyserver/caddy/v2@v2.11.2
2.11.4
1
library/caddy:2.4.5874405536b3e
github.com/caddyserver/caddy/v2@v2.4.5
2.11.4
1
library/caddy:2.9-alpineb4e3952384eb
github.com/caddyserver/caddy/v2@v2.9.1
2.11.4
1
library/caddy:2.4.2-alpinefbc51bcf1ab0
github.com/caddyserver/caddy/v2@v2.4.2
2.11.4
1
novosga/novosga:latest34b9acbe6e51
github.com/caddyserver/caddy/v2@v2.11.2
2.11.4
1
ghcr.io/browsersec/kubebrowse-frontend:chore-improve-backbd6bea5e487c
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4
1
ghcr.io/gurucomputing/headscale-ui:2026.03.17015f5ba04bcb
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4
1
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
github.com/caddyserver/caddy/v2@v2.9.1
2.11.4
1
ghcr.io/loafoe/caddy-token:v0.3.0528f2174fa2f
github.com/caddyserver/caddy/v2@v2.8.4
2.11.4
1
ghcr.io/loafoe/solgate:v0.0.12b3256cbc7b68
github.com/caddyserver/caddy/v2@v2.7.4
2.11.4
1
ghcr.io/riotkit-org/waf-proxy:snapshot683656fdace2
github.com/caddyserver/caddy/v2@v2.5.1
2.11.4
1
public.ecr.aws/docker/library/caddy:2.6.387cbd356af2e
github.com/caddyserver/caddy/v2@v2.6.3
2.11.4
1
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
github.com/caddyserver/caddy/v2@v2.5.1
2.11.4
1
registry.gitlab.com/parrotsec/project/parrot-mirror-docker:mainf91b602ca572
github.com/caddyserver/caddy/v2@v2.7.4
2.11.4
1

syft 1.42.1 · advisories as of 20 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.