chore(oci/library/caddy): update 2.11.2 ➼ 8344681

[tinfoild]

This PR contains the following updates:

Package	Update	Change	OpenSSF
public.ecr.aws/docker/library/caddy (source)	digest	fce4f15 → 8344681

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone Asia/Singapore)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[cloudflare-workers-and-pages]

Deploying jjgadgets-biohazard with    Cloudflare Pages

Latest commit:	ffaa0df
Status:	🚫  Build failed.

View logs

[tinfoild]

kube/helmrelease/out00

--- HelmRelease: rook-ceph/rgw Deployment: rook-ceph/rgw

+++ HelmRelease: rook-ceph/rgw Deployment: rook-ceph/rgw

@@ -60,13 +60,13 @@

         topologyKey: kubernetes.io/hostname
         whenUnsatisfiable: DoNotSchedule
       containers:
       - env:
         - name: TZ
           value: null
-        image: public.ecr.aws/docker/library/caddy:2.11.2-alpine@sha256:fce4f15aad23222c0ac78a1220adf63bae7b94355d5ea28eee53910624acedfa
+        image: public.ecr.aws/docker/library/caddy:2.11.2-alpine@sha256:834468128c7696cec0ceea6172f7d692daf645ae51983ca76e39da54a97c570d
         livenessProbe:
           failureThreshold: 3
           initialDelaySeconds: 0
           periodSeconds: 10
           tcpSocket:
             port: 80

[tinfoild]

kube/kustomization/out00

--- kube/deploy/core/storage/rook-ceph/cluster/biohazard Kustomization: flux-system/1-core-storage-rook-ceph-cluster HelmRelease: rook-ceph/rgw

+++ kube/deploy/core/storage/rook-ceph/cluster/biohazard Kustomization: flux-system/1-core-storage-rook-ceph-cluster HelmRelease: rook-ceph/rgw

@@ -58,13 +58,13 @@

         containers:
           main:
             env:
               TZ: null
             image:
               repository: public.ecr.aws/docker/library/caddy
-              tag: 2.11.2-alpine@sha256:fce4f15aad23222c0ac78a1220adf63bae7b94355d5ea28eee53910624acedfa
+              tag: 2.11.2-alpine@sha256:834468128c7696cec0ceea6172f7d692daf645ae51983ca76e39da54a97c570d
             probes:
               liveness:
                 enabled: true
               readiness:
                 enabled: true
             resources:

[ciel-shieru]

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-24 03:50 UTC
🤖 Scanner: Ciel Security Scanner
🔗 PR: #5476 — chore(oci/library/caddy): update 2.11.2 ➼ 8344681
📦 Packages checked: 1
🔍 Sources: NVD, OSV.dev, GHSA, GHSL, CISA KEV, FortiGuard, CVE.org, Changelog
⚠️ Vulnerabilities found: 4 (2 HIGH, 2 MEDIUM)

---

Severity Summary

Severity	Count
CRITICAL	0
HIGH	2
MEDIUM / MODERATE	2
LOW	0
UNKNOWN / NEEDS VERIFICATION	0
Total	4

---

Results

Package: public.ecr.aws/docker/library/caddy (Caddy)

• Ecosystem: Docker (Go-based web server image, Alpine Linux base)
• Old version: 2.11.2-alpine@sha256:fce4f15 — VULNERABLE (4 CVEs)
• New version: 2.11.2-alpine@sha256:8344681 — VULNERABLE (same 4 CVEs — same Caddy version, digest-only rebuild)

⚠️ Note: This is a digest-only update — the Caddy version tag (2.11.2-alpine) is unchanged. The difference in SHA256 digest reflects a rebuild of the Docker image (likely Alpine base layer updates). Both old and new images run Caddy v2.11.2, so Caddy-level vulnerabilities are identical in both.

Vulnerabilities in Caddy v2.11.2 (both old and new)

1. CVE-2026-45135 / GHSA-m675-2p33-xv9g — Severity: HIGH (CVSS 8.1)

   • Description: FastCGI splitPos path confusion allows non-PHP files to be executed as scripts when using FastCGI.
   • Affected versions: >= 2.7.0, < 2.11.3
   • Fixed in: 2.11.3
   • Sources: NVD, GHSA
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-45135 | GHSA-m675-2p33-xv9g
   • Status: ❌ Affected — present in both old and new

2. CVE-2026-52845 / GHSA-f59h-q822-g45g — Severity: HIGH (CVSS 8.1)

   • Description: forward_auth copy_headers can be bypassed via underscore-alias header injection, allowing identity/group header spoofing to PHP/FastCGI backends.
   • Affected versions: < 2.11.4
   • Fixed in: 2.11.4
   • Sources: NVD, GHSA
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-52845 | GHSA-f59h-q822-g45g
   • Status: ❌ Affected — present in both old and new

3. CVE-2026-45692 / GHSA-x5w9-xh9r-mvfc — Severity: MEDIUM (CVSS 5.4)

   • Description: Admin config path traversal: string prefix matching vs numeric array index parsing allows authorization bypass for config traversal.
   • Affected versions: >= 2.4.0, < 2.11.3
   • Fixed in: 2.11.3
   • Sources: NVD, GHSA
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-45692 | GHSA-x5w9-xh9r-mvfc
   • Status: ❌ Affected — present in both old and new

4. CVE-2026-52846 / GHSA-vcc4-2c75-vc9v — Severity: MEDIUM (CVSS 4.2)

   • Description: stripHTML template function cannot reliably remove malformed HTML tags, potentially leaving XSS vectors in template output.
   • Affected versions: < 2.11.4
   • Fixed in: 2.11.4
   • Sources: NVD, GHSA
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-52846 | GHSA-vcc4-2c75-vc9v
   • Status: ❌ Affected — present in both old and new

Non-applicable findings (verified and excluded)

Finding	Severity	Reason not applicable
CVE-2026-52844 (Windows path bypass)	HIGH	Windows-only vulnerability; image runs Alpine Linux
CVE-2026-27585—CVE-2026-27590 (6 CVEs)	CRITICAL/HIGH/MEDIUM	All fixed in Caddy 2.11.1; 2.11.2 includes the fixes
CVE-2026-30851 (forward_auth injection)	HIGH	Fixed in Caddy 2.11.2 (the version in use)
CVE-2026-30852 (vars_regexp double-expansion)	HIGH	Fixed in Caddy 2.11.2 (the version in use)
CVE-2018-21246, CVE-2022-29718, CVE-2022-28923, and older	CRITICAL/MEDIUM	All fixed in versions ≤ 2.4.x — long before 2.11.x
CVE-2023-45084, CVE-2023-49854, CVE-2025-30207	HIGH/MEDIUM	Not Caddy web server — unrelated products sharing the name "caddy"
Plugin CVEs (caddy-security, caddy-geo-ip, caddy-proxyprotocol)	VARIOUS	Plugin-specific; not core Caddy server
CVE-2026-25748 (authentik)	HIGH	authentik vulnerability that uses Caddy as reverse proxy — not a Caddy bug

Changelog Security Highlights (Caddy version gap 2.11.2 → current)

Caddy 2.11.2 was released with:

• v2.11.3 — FastCGI path confusion fix (CVE-2026-45135); admin auth bypass fixes (CVE-2026-45692); vars_regexp hardening; quic-go/CertMagic upstream security bumps
• v2.11.4 — Windows path normalization (CVE-2026-52844); rewrite placeholder re-expansion prevention; stripHTML improvement (CVE-2026-52846); underscore header injection fix (CVE-2026-52845)

The PR itself only updates the Docker image digest (same Caddy tag), so none of these are addressed.

Source scan summary

Source	Status	Notes
NVD	✅ Scanned	4 applicable CVEs found in Caddy 2.11.2
OSV.dev	✅ Scanned	Confirmed CVEs via Go and Ubuntu ecosystems
GHSA	✅ Scanned	4 relevant advisories matching core Caddy
GHSL	✅ Scanned	No security-lab publications found for Caddy
CISA KEV	✅ Scanned	No KEV entries for Caddy web server
FortiGuard	✅ Scanned	No Fortinet advisories referencing Caddy
CVE.org	✅ Scanned	No additional unique CVEs beyond NVD results
Changelog	✅ Scanned	Comprehensive Caddy release notes analyzed (v2.11.1 → v2.11.4)

---

Recommendations

• MERGE PRIORITY: HIGH — The old version (Caddy 2.11.2) has 2 HIGH-severity and 2 MEDIUM-severity CVEs. This digest-only update does not fix them (same Caddy version) but may include Alpine base image security patches.
• ⚠️ Critical note: This PR is a digest update only (same Caddy version 2.11.2-alpine, rebuilt Docker image). The Caddy-level vulnerabilities listed above are not remediated by this PR. A version bump to Caddy 2.11.3 or 2.11.4 is needed to fix CVE-2026-45135 and others.
• This PR is still worth merging for base image freshness, but a separate PR to update the actual Caddy version tag is strongly recommended.
• No new vulnerabilities are introduced by the new digest.

---

⚠️ This comment was posted by an automated security scanner (Ciel).
To re-scan, trigger the renovate-security-scanner skill.