Caddy v2.11.4

v2.11.4
Added 2
  • Add candidate placeholders for rejected identities in caddyauth
  • Support caddy start on IPv6-only hosts in cmd
Changed 3
  • Preserve implicit TLS issuer semantics in caddyfile
  • Prioritize zstd and br over gzip in content negotiation in encode
  • Optimize memory allocation for file placeholders in replacer
Fixed 8
  • Fix client auth in caddytls
  • Further prevent body closes from dial errors in reverseproxy
  • Omit Last-Modified header for unusable modification times in caddyhttp
  • Fix TLS state races and ECH rotation retry in caddytls
  • Wrap request body in reverseproxy to prevent closing if not read
  • Match IDN SNI in connection policies in caddytls
  • Skip idna.ToASCII for pure ASCII SNI values in caddytls
  • Fix incorrect error message on duplicate matchers in httpcaddyfile
Security 4
  • Normalize Windows backslashes in path matcher in caddyhttp
  • Prevent placeholder re-expansion in injected query in rewrite
  • Improve stripHTML action to more reliably remove malformed HTML in templates
  • Ignore header fields with underscores in caddyhttp to prevent collisions

From Caddy

This release patches more security, security-adjacent, and normal bugs. The FrankenPHP project has collaborated on PHP-adjacent patches, which we are grateful for.

The recent surge of patches is mostly attributed to token predictors. We have had to reject more than 75% of "security" reports because they were AI slop spam (or just lazy/incorrect). Please use LLMs and agents wisely to avoid wasting precious maintainer resources. We have started blocking offending accounts that spam slop reports. Thank you to all who submit responsible reports following our security policy to make the project better. We appreciate that the community deems the Caddy project worthy of contribution to improve the broader ecosystem!

Security-related patches:

  • caddyhttp: Normalize Windows backslashes in path matcher (thanks @Vincent550102)
  • rewrite: Prevent placeholder re-expansion in injected query (thanks @WhiskerEnt)
  • templates: Improved stripHTML action to more reliably remove malformed HTML (thanks to @jmrcsnchz)
  • caddyhttp: Ignore header fields with underscores to prevent collisions (thanks @Vincent550102 for the report and @dunglas for the patch)

:warning: These security patches may be breaking if your application relies on the buggy behaviors.

There are also several other various fixes and enhancements by many other contributors. Thank you everyone who participated!

What's Changed
New Contributors

Full Changelog: https://github.com/caddyserver/caddy/compare/v2.11.3...v2.11.4

View original

Upgraded? How did it go?

Discussion