Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non-.php (or other configured split_path extension) file as a script. In any deployment where the attacker can place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This vulnerability is fixed in 2.11.3.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI     transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses     golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two     distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non-.php     (or other configured split_path extension) file as a script. In any deployment where the attacker can     place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to     remote code execution by crafting a URL whose path triggers either flaw. This vulnerability is fixed in     2.11.3. (CVE-2026-45135)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI
    transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses
    golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two
    distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non-.php
    (or other configured split_path extension) file as a script. In any deployment where the attacker can
    place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to
    remote code execution by crafting a URL whose path triggers either flaw. This vulnerability is fixed in
    2.11.3. (CVE-2026-45135)

  - Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the
    authorization layer and the /config traversal layer do not agree on what object the path refers to. In
    this case, a path authorized for one config object is accepted, but then resolves to a different config
    object during traversal. This happens because the authorization layer uses string prefix matching and the
    /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed
    in 2.11.3. (CVE-2026-45692)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI
    transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses
    golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two
    distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non-.php
    (or other configured split_path extension) file as a script. In any deployment where the attacker can
    place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to
    remote code execution by crafting a URL whose path triggers either flaw. This vulnerability is fixed in
    2.11.3. (CVE-2026-45135)

ID	Name	Product	Family	Severity
322469	Linux Distros Unpatched Vulnerability : CVE-2026-45135	Nessus	Misc.	high
443105	Alpine: multiple caddy packages: security update to 2.11.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	low
443105	Alpine: multiple caddy packages: security update to 2.11.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	low
442061	SCA: security update for github.com/caddyserver/caddy/v2 (GHSA-m675-2p33-xv9g)	Tenable Cloud Security	SCA Checks	high
442061	SCA: security update for github.com/caddyserver/caddy/v2 (GHSA-m675-2p33-xv9g)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-45135

high

Tenable Plugins

high

low

low

high

high