StackRadar

GO-2026-6512

Medium

Advisory

Published 18 Sept 2026In the index since 24 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.005
40th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
28
of 17,985 indexed, latest versions
Container images
24
deployed by those charts
Fix available
1 of 1
affected package

Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass

Carried by container images the latest versions of 28 of 17,985 indexed charts deploy, on 24 images.

Affected packageAffected versionsFixed inImages
github.com/caddyserver/caddy/v2golangv2.2.0, v2.4.0, v2.4.2, v2.4.5+12 more2.11.424
OSV records
GHSA-j8px-rmrx-76h9GO-2026-6512
Also known as
CVE-2026-77281, CVE-2026-92284, CVE-2026-92700

Charts affected

28 by stars
ChartLatestAffected imagesRadar Score
baserowbaserow-chartVerified publisher1.1.01 of 6See more

baserow baserow-chart 1.1.0

1 of the 6 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
caddy/ingress:v0.2.118d1366fc0e9
github.com/caddyserver/caddy/v2@v2.7.5
2.11.4

Open the chart page →

19,167
caddy-ingress-controllercaddy-ingress1.3.01 of 1See more

caddy-ingress-controller caddy-ingress 1.3.0

1 of the 1 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
caddy/ingress:v0.2.118d1366fc0e9
github.com/caddyserver/caddy/v2@v2.7.5
2.11.4

Open the chart page →

2,405
convertigoconvertigoOfficialVerified publisher8.4.51 of 5See more

convertigo convertigo 8.4.5

1 of the 5 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
github.com/caddyserver/caddy/v2@v2.7.6
2.11.4

Open the chart page →

17,216
kubeviouskubevious1.2.21 of 7See more

kubevious kubevious 1.2.2

1 of the 7 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
kubevious/ui:1.2.16233e84bdd59
github.com/caddyserver/caddy/v2@v2.6.1
2.11.4

Open the chart page →

17,414
wordpress-hardenedriotkit-org2.0.01 of 2See more

wordpress-hardened riotkit-org 2.0.0

1 of the 2 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
ghcr.io/riotkit-org/waf-proxy:snapshot683656fdace2
github.com/caddyserver/caddy/v2@v2.5.1
2.11.4

Open the chart page →

8,124
maintenancecodewithemadVerified publisher0.1.61 of 1See more

maintenance codewithemad 0.1.6

1 of the 1 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
library/caddy:2.9-alpineb4e3952384eb
github.com/caddyserver/caddy/v2@v2.9.1
2.11.4

Open the chart page →

1,890
gboxgboxVerified publisher1.0.51 of 2See more

gbox gbox 1.0.5

1 of the 2 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
gboxproxy/gbox:v1.0.63a9f4a711d5c
github.com/caddyserver/caddy/v2@v2.5.0
2.11.4

Open the chart page →

3,355
headscale-uiheadscale-uiVerified publisher0.2.91 of 1See more

headscale-ui headscale-ui 0.2.9

1 of the 1 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
ghcr.io/gurucomputing/headscale-ui:2026.03.17015f5ba04bcb
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4

Open the chart page →

1,780
kubebrowsekubebrowse1.7.01 of 5See more

kubebrowse kubebrowse 1.7.0

1 of the 5 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
ghcr.io/browsersec/kubebrowse-frontend:chore-improve-backbd6bea5e487c
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4

Open the chart page →

3,632
wordpress-helmwordpress-helm0.2.91 of 4See more

wordpress-helm wordpress-helm 0.2.9

1 of the 4 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
aapjeisbaas/wp-frankenphp:v0.2.26b261abc7fb0
github.com/caddyserver/caddy/v2@v2.11.3
2.11.4

Open the chart page →

9,436
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
caddy/ingress:v0.2.118d1366fc0e9
github.com/caddyserver/caddy/v2@v2.7.5
2.11.4

Open the chart page →

11,816
caddycaddyVerified publisher0.0.41 of 1See more

caddy caddy 0.0.4

1 of the 1 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
library/caddy:2.11.2-alpine834468128c76
github.com/caddyserver/caddy/v2@v2.11.2
2.11.4

Open the chart page →

1,968
mercurecloudnativeapp1.0.21 of 1See more

mercure cloudnativeapp 1.0.2

1 of the 1 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
dunglas/mercure:v0916834e49961
github.com/caddyserver/caddy/v2@v2.11.3
2.11.4

Open the chart page →

1,266
parrot-mirroremmas-chartsVerified publisher1.0.01 of 1See more

parrot-mirror emmas-charts 1.0.0

1 of the 1 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
registry.gitlab.com/parrotsec/project/parrot-mirror-docker:mainf91b602ca572
github.com/caddyserver/caddy/v2@v2.7.4
2.11.4

Open the chart page →

2,803
supportpalevilgn0me0.1.61 of 1See more

supportpal evilgn0me 0.1.6

1 of the 1 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
github.com/caddyserver/caddy/v2@v2.5.1
2.11.4

Open the chart page →

22,795
fluxer-helmfluxer-helm0.3.01 of 18See more

fluxer-helm fluxer-helm 0.3.0

1 of the 18 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
ghcr.io/fluxerapp/fluxer-static:2026.812.125337cfe98ae544df
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4

Open the chart page →

31,226
searxgeek-cookbookVerified publisher5.6.21 of 4See more

searx geek-cookbook 5.6.2

1 of the 4 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
library/caddy:2.2.0-alpine7367adca165f
github.com/caddyserver/caddy/v2@v2.2.0
2.11.4

Open the chart page →

10,079
vikunjageek-cookbookVerified publisher6.2.01 of 4See more

vikunja geek-cookbook 6.2.0

1 of the 4 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
library/caddy:2.4.2-alpinefbc51bcf1ab0
github.com/caddyserver/caddy/v2@v2.4.2
2.11.4

Open the chart page →

9,512
castopodhelmforgeVerified publisher1.2.91 of 3See more

castopod helmforge 1.2.9

1 of the 3 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
castopod/castopod:1.15.54e4f0440520f
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4

Open the chart page →

10,457
discount-bandithelmforgeVerified publisher2.0.91 of 3See more

discount-bandit helmforge 2.0.9

1 of the 3 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
cybrarist/discount-bandit:v4.0.4e9e2447ac666
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4

Open the chart page →

33,407
pimcorehelmforgeVerified publisher2.0.31 of 6See more

pimcore helmforge 2.0.3

1 of the 6 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
dunglas/mercure:v0.24.2916834e49961
github.com/caddyserver/caddy/v2@v2.11.3
2.11.4

Open the chart page →

3,170
ryothelmforgeVerified publisher1.0.01 of 2See more

ryot helmforge 1.0.0

1 of the 2 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
github.com/caddyserver/caddy/v2@v2.9.1
2.11.4

Open the chart page →

6,836
op-scim-bridgelifen1.0.31 of 2See more

op-scim-bridge lifen 1.0.3

1 of the 2 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
1password/scim:v2.3.129d0c6cb67eb
github.com/caddyserver/caddy/v2@v2.4.0
2.11.4

Open the chart page →

4,105
op-scim-bridgelifen-chartsVerified publisher1.0.31 of 2See more

op-scim-bridge lifen-charts 1.0.3

1 of the 2 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
1password/scim:v2.3.129d0c6cb67eb
github.com/caddyserver/caddy/v2@v2.4.0
2.11.4

Open the chart page →

4,105
solgateloafoe0.0.121 of 1See more

solgate loafoe 0.0.12

1 of the 1 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
ghcr.io/loafoe/solgate:v0.0.12b3256cbc7b68
github.com/caddyserver/caddy/v2@v2.7.4
2.11.4

Open the chart page →

2,667
gitlab-proxyopslevelVerified publisher0.0.81 of 1See more

gitlab-proxy opslevel 0.0.8

1 of the 1 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
library/caddy:2.660fb54d36b4b
github.com/caddyserver/caddy/v2@v2.6.4
2.11.4

Open the chart page →

2,537
caddysagikazarmarkVerified publisher0.0.141 of 1See more

caddy sagikazarmark 0.0.14

1 of the 1 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
library/caddy:2.4.5874405536b3e
github.com/caddyserver/caddy/v2@v2.4.5
2.11.4

Open the chart page →

3,926
tfy-cloudflaredtruefoundryVerified publisher0.6.01 of 2See more

tfy-cloudflared truefoundry 0.6.0

1 of the 2 container images this version deploys carry GO-2026-6512.

Container imageDigestPackageFixed in
public.ecr.aws/docker/library/caddy:2.6.387cbd356af2e
github.com/caddyserver/caddy/v2@v2.6.3
2.11.4

Open the chart page →

2,680

Container images carrying it

24 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
caddy/ingress:v0.2.118d1366fc0e9
github.com/caddyserver/caddy/v2@v2.7.5
github.com/caddyserver/caddy/v2@v2.7.5
2.11.4
2.11.4
3
1password/scim:v2.3.129d0c6cb67eb
github.com/caddyserver/caddy/v2@v2.4.0
github.com/caddyserver/caddy/v2@v2.4.0
2.11.4
2.11.4
2
dunglas/mercure:v0:v0.24.2916834e49961
github.com/caddyserver/caddy/v2@v2.11.3
github.com/caddyserver/caddy/v2@v2.11.3
2.11.4
2.11.4
2
aapjeisbaas/wp-frankenphp:v0.2.26b261abc7fb0
github.com/caddyserver/caddy/v2@v2.11.3
github.com/caddyserver/caddy/v2@v2.11.3
2.11.4
2.11.4
1
baserow/baserow:1.30.1df0c42eb67e8
github.com/caddyserver/caddy/v2@v2.7.6
github.com/caddyserver/caddy/v2@v2.7.6
2.11.4
2.11.4
1
castopod/castopod:1.15.54e4f0440520f
github.com/caddyserver/caddy/v2@v2.10.2
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4
2.11.4
1
cybrarist/discount-bandit:v4.0.4e9e2447ac666
github.com/caddyserver/caddy/v2@v2.10.2
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4
2.11.4
1
gboxproxy/gbox:v1.0.63a9f4a711d5c
github.com/caddyserver/caddy/v2@v2.5.0
github.com/caddyserver/caddy/v2@v2.5.0
2.11.4
2.11.4
1
kubevious/ui:1.2.16233e84bdd59
github.com/caddyserver/caddy/v2@v2.6.1
github.com/caddyserver/caddy/v2@v2.6.1
2.11.4
2.11.4
1
library/caddy:2.660fb54d36b4b
github.com/caddyserver/caddy/v2@v2.6.4
github.com/caddyserver/caddy/v2@v2.6.4
2.11.4
2.11.4
1
library/caddy:2.2.0-alpine7367adca165f
github.com/caddyserver/caddy/v2@v2.2.0
github.com/caddyserver/caddy/v2@v2.2.0
2.11.4
2.11.4
1
library/caddy:2.11.2-alpine834468128c76
github.com/caddyserver/caddy/v2@v2.11.2
github.com/caddyserver/caddy/v2@v2.11.2
2.11.4
2.11.4
1
library/caddy:2.4.5874405536b3e
github.com/caddyserver/caddy/v2@v2.4.5
github.com/caddyserver/caddy/v2@v2.4.5
2.11.4
2.11.4
1
library/caddy:2.9-alpineb4e3952384eb
github.com/caddyserver/caddy/v2@v2.9.1
github.com/caddyserver/caddy/v2@v2.9.1
2.11.4
2.11.4
1
library/caddy:2.4.2-alpinefbc51bcf1ab0
github.com/caddyserver/caddy/v2@v2.4.2
github.com/caddyserver/caddy/v2@v2.4.2
2.11.4
2.11.4
1
ghcr.io/browsersec/kubebrowse-frontend:chore-improve-backbd6bea5e487c
github.com/caddyserver/caddy/v2@v2.10.2
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4
2.11.4
1
ghcr.io/fluxerapp/fluxer-static:2026.812.125337cfe98ae544df
github.com/caddyserver/caddy/v2@v2.10.2
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4
2.11.4
1
ghcr.io/gurucomputing/headscale-ui:2026.03.17015f5ba04bcb
github.com/caddyserver/caddy/v2@v2.10.2
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4
2.11.4
1
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
github.com/caddyserver/caddy/v2@v2.9.1
github.com/caddyserver/caddy/v2@v2.9.1
2.11.4
2.11.4
1
ghcr.io/loafoe/solgate:v0.0.12b3256cbc7b68
github.com/caddyserver/caddy/v2@v2.7.4
github.com/caddyserver/caddy/v2@v2.7.4
2.11.4
2.11.4
1
ghcr.io/riotkit-org/waf-proxy:snapshot683656fdace2
github.com/caddyserver/caddy/v2@v2.5.1
github.com/caddyserver/caddy/v2@v2.5.1
2.11.4
2.11.4
1
public.ecr.aws/docker/library/caddy:2.6.387cbd356af2e
github.com/caddyserver/caddy/v2@v2.6.3
github.com/caddyserver/caddy/v2@v2.6.3
2.11.4
2.11.4
1
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
github.com/caddyserver/caddy/v2@v2.5.1
github.com/caddyserver/caddy/v2@v2.5.1
2.11.4
2.11.4
1
registry.gitlab.com/parrotsec/project/parrot-mirror-docker:mainf91b602ca572
github.com/caddyserver/caddy/v2@v2.7.4
github.com/caddyserver/caddy/v2@v2.7.4
2.11.4
2.11.4
1

syft 1.42.1 · advisories as of 3 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.