DockerState

Home › Web servers and proxies › caddy › 2

caddy:2

The Caddy web server with automatic HTTPS, tag 2, built on Alpine Linux 3.23.7. Pushed to Docker Hub 2 days ago.

Critical 1High 9Medium 18Low 45Unknown 3Starts as root7 platforms

25 MBdownload (compressed)
67 MBunpacked on disk
5filesystem layers
181packages
231files
docker pull caddy:2caddy@sha256:36c24ad91a7ff7bc4c87fe22bfa8df3c4b18da0773d73fc12ee2c52b98c0bb7e

Size per platform

Compressed download size on Docker Hub for each architecture.

  • amd6425 MB
  • s390x24 MB
  • riscv6424 MB
  • arm6424 MB
  • arm/v624 MB
  • ppc64le23 MB
  • arm/v723 MB

Where the bytes go

Unpacked bytes by directory in the final amd64 filesystem.

  • /usr/bin52 MB
  • /usr/lib11 MB
  • /bin805 kB
  • /lib666 kB
  • /etc/ssl204 kB
  • /usr/share/ca-certificates179 kB
  • /sbin115 kB
  • /usr/sbin103 kB
  • /usr/lib/engines-3102 kB
  • /usr/lib/ossl-modules100 kB

Layers

The 5 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.

Full build steps
  1. 3.9 MBADD alpine-minirootfs-3.23.7-x86_64.tar.gz / # buildkit
  2. 2.8 MBRUN /bin/sh -c apk add --no-cache ca-certificates curl libcap mailcap # buildkit
  3. 8 kBRUN /bin/sh -c set -eux; mkdir -p /config/caddy /data/caddy /etc/caddy /usr/share/caddy ; chmod 1777 /config/caddy /data/caddy; wget -O /etc/caddy/Caddyfile "https://github.com/caddyserver/dist/raw/33ae08ff08d168572df2956ed14fbc4949880d94/config/Caddyfile"; wget -O /usr/share/caddy/index.html "https://github.com/caddyserver/dist/raw/33ae08ff08d168572df2956ed14fbc4949880d94/welcome/index.html" # buildkit
  4. 18 MBRUN /bin/sh -c set -eux; apkArch="$(apk --print-arch)"; case "$apkArch" in x86_64) binArch='amd64'; checksum='a7a433a1b133efc3c8d10eb0b99d52a24b5ef5c322dc77f5282182b1c0402139ab83f3a99f0c52409df77d20123fb0b523edad8a66d8f5e49136197bf61ef0e7' ;; armhf) binArch='armv6'; checksum='139d7eb079be6b9fcdb2b707424e3c0c4f20f522c4f156fd27fdd05d6eaebf8c8f966104d24adfc3a5b8982626cebbec84f1c3c1b7a68edb1693e64e9708c22b' ;; armv7) binArch='armv7'; checksum='6eb3894f9a215f75f3ec50e627c34b2cd6fb81d10ec7838f27c30dcf417b810f618136b507766bc17e7400a5c0f4fa6001bb062ebb7a401ee63505012615825e' ;; aarch64)
  5. 32 BWORKDIR /srv

Known vulnerabilities

1Critical1 with a fix
9High8 with a fix
18Medium16 with a fix
45Low45 with a fix
3Unknown2 with a fix

76 findings across 181 packages; 72 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.

SeverityVulnerabilityAffected packagesFixed in
Critical CVE-2026-111497brotli: Out-of-Bounds Write in Google Brotli Decoder brotli-libsinstalled 1.2.0-r0 1.2.1-r0
High CVE-2026-111943crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates stdlibinstalled v1.26.8 1.26.10, 1.27.3
High CVE-2026-116587github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs github.com/go-jose/go-jose/v4, github.com/go-jose/go-jose/v3installed v4.1.5 4.1.6
High CVE-2026-78667net/http: golang: golang: Denial of Service via crafted HTTP Range headers stdlibinstalled v1.26.8 1.26.9, 1.27.2
High CVE-2026-78669net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames golang.org/x/net, stdlibinstalled v0.59.0 0.60.0, 1.26.9, 1.27.2
High CVE-2026-92392curl: curl: HTTP/2 upload Use-After-Free curl, libcurlinstalled 8.22.0-r0 8.23.0-r0
High CVE-2026-97031crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references stdlibinstalled v1.26.8 1.26.9, 1.27.2
Medium CVE-2026-114437github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware github.com/go-chi/chi/v5installed v5.3.2 5.4.0
Medium CVE-2026-56866net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections stdlibinstalled v1.26.8 1.26.9, 1.27.2
Medium CVE-2026-78659net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion golang.org/x/net, stdlibinstalled v0.59.0 0.60.0, 1.26.9, 1.27.2
Medium CVE-2026-78660net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers golang.org/x/net, stdlibinstalled v0.59.0 0.60.0, 1.26.9, 1.27.2
Medium CVE-2026-78663net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server golang.org/x/net, stdlibinstalled v0.59.0 0.60.0, 1.26.9, 1.27.2
Medium CVE-2026-92388curl: curl: FTP wildcard write callback mixup curl, libcurlinstalled 8.22.0-r0 8.23.0-r0
Medium CVE-2026-94439net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses stdlibinstalled v1.26.8 1.26.9, 1.27.2
Medium CVE-2026-94440net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing stdlibinstalled v1.26.8 1.26.9, 1.27.2
Medium CVE-2026-94448html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals stdlibinstalled v1.26.8 1.26.9, 1.27.2
Medium CVE-2026-97030html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword stdlibinstalled v1.26.8 1.26.9, 1.27.2
Medium CVE-2026-97032net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification golang.org/x/net, stdlibinstalled v0.59.0 0.60.0, 1.26.9, 1.27.2
Medium CVE-2026-116585github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption github.com/go-jose/go-jose/v3installed v3.0.5 no fix yet
Medium CVE-2026-116586github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing github.com/go-jose/go-jose/v3installed v3.0.5 no fix yet
Low CVE-2026-107928curl: curl: info leak uploading over WebSockets with GnuTLS curl, libcurlinstalled 8.22.0-r0 8.23.0-r0
Low CVE-2026-107929curl: curl: local interface connection reuse mixup curl, libcurlinstalled 8.22.0-r0 8.23.0-r0
Low CVE-2026-56857os: golang: golang: Directory traversal via Windows junction handling stdlibinstalled v1.26.8 1.26.9, 1.27.2
Low CVE-2026-86409curl: curl: stale SigV4 headers sent unintended curl, libcurlinstalled 8.22.0-r0 8.23.0-r0
Low CVE-2026-86410curl: curl: redirect to SFTP or SCP bypasses host verification curl, libcurlinstalled 8.22.0-r0 8.23.0-r0
Low CVE-2026-86411curl: curl: FTP connection reuse inherits client-certificate curl, libcurlinstalled 8.22.0-r0 8.23.0-r0
Low CVE-2026-86412curl: curl: server-set cookie erases cookie jar curl, libcurlinstalled 8.22.0-r0 8.23.0-r0
Low CVE-2026-86413curl: curl: Negotiate credentials sent to redirected origin curl, libcurlinstalled 8.22.0-r0 8.23.0-r0
Low CVE-2026-86414curl: curl: leaking host credentials to HTTP proxy curl, libcurlinstalled 8.22.0-r0 8.23.0-r0
Low CVE-2026-86415curl: curl: auto client cert connection reuse mixup curl, libcurlinstalled 8.22.0-r0 8.23.0-r0
Low CVE-2026-87861curl: curl: cross-origin reuse of a Negotiate connection curl, libcurlinstalled 8.22.0-r0 8.23.0-r0
Low CVE-2026-87862curl: curl: HSTS cache import drops longer-lived child curl, libcurlinstalled 8.22.0-r0 8.23.0-r0
Low CVE-2026-87863curl: curl: Hsts Response Erases Persisted Entries curl, libcurlinstalled 8.22.0-r0 8.23.0-r0
Low CVE-2026-87864curl: IMAP APPEND plus CRLF conversion command injection curl, libcurlinstalled 8.22.0-r0 8.23.0-r0
Low CVE-2026-87865curl: curl: knownhost callback mismatches key as missing curl, libcurlinstalled 8.22.0-r0 8.23.0-r0
Low CVE-2026-87866curl: curl: wolfSSL public-key pinning bypass curl, libcurlinstalled 8.22.0-r0 8.23.0-r0
Low CVE-2026-92386curl: curl: server-set cookie aborts cookie jar load curl, libcurlinstalled 8.22.0-r0 8.23.0-r0
Low CVE-2026-92387curl: curl: never-ending loop via server response omission curl, libcurlinstalled 8.22.0-r0 8.23.0-r0
Low CVE-2026-92389curl: curl: TFTP direction confusion curl, libcurlinstalled 8.22.0-r0 8.23.0-r0
Low CVE-2026-92390curl: curl: -J no-clobber guarantee bypassed with 103 early hints curl, libcurlinstalled 8.22.0-r0 8.23.0-r0

Showing the 40 most severe of 46 distinct vulnerabilities (76 findings, one per affected package).

Packages

Go modules
149
Alpine packages
32

Image configuration

Base OS
Alpine Linux 3.23.7
Default user
root (no USER set; the entrypoint may still drop privileges)
Entrypoint
—
Command
caddy run --config /etc/caddy/Caddyfile --adapter caddyfile
Exposed ports
2019/tcp, 443/tcp, 443/udp, 80/tcp
Image created
2026-10-21
amd64 digest
sha256:04913b1da43339a40ad1ea87827d70a576ac5aa6cf674c6e24fdca675887533a

Other Caddy tags

Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-26 from digest sha256:04913b1da433. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.