DEBIAN-CVE-2026-52846

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-52846
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-52846.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-52846
Upstream
Published
2026-06-23T18:18:05.400Z
Modified
2026-06-25T23:00:32.147970120Z
Severity
  • 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. This vulnerability is fixed in 2.11.4.

References

Affected packages

Debian:12 / caddy

Package

Name
caddy
Purl
pkg:deb/debian/caddy?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.6.2-5
2.6.2-6
2.6.2-6.1
2.6.2-7
2.6.2-8
2.6.2-9
2.6.2-10
2.6.2-11
2.6.2-12
2.6.2-13
2.6.2-14
2.11.2-1~bpo13+1
2.11.2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-52846.json"

Debian:13 / caddy

Package

Name
caddy
Purl
pkg:deb/debian/caddy?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.6.2-12
2.6.2-13
2.6.2-14
2.11.2-1~bpo13+1
2.11.2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-52846.json"

Debian:14 / caddy

Package

Name
caddy
Purl
pkg:deb/debian/caddy?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.6.2-12
2.6.2-13
2.6.2-14
2.11.2-1~bpo13+1
2.11.2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-52846.json"