Vulnerability Reportcaddy:2.11.7

caddy:2.11.7
digestsha256:36c24ad91a7ff7bc4c87fe22bfa8df3c4b18da0773d73fc12ee2c52b98c0bb7e

Executive Summary

Last scanned:

Threat Score
58/100CAUTION
Reputation
TRUSTED

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker who can reach port 443 could slow or crash the web service by flooding its HTTP/2 handling, disrupting availability for every user. The scan found no known actively exploited issues, and the container's root default means the main practical risk is service disruption rather than direct data theft. Several other findings only matter when specific features are enabled, such as reverse proxying to HTTP/2 upstreams for CVE-2026-78660 or static file serving. Updating golang.org/x/net and the Go standard library to fixed versions is the practical path to reduce this exposure.

Hardening plan for this image · 5 steps. The first cuts risk from 58 to 0.

Included in Pro

Scanning procedure

  1. Vulnerability scan
    Full CVE sweep across OS packages and app dependencies
  2. Exploitability check
    CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
  3. Reachability analysis
    Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
  4. Runtime verification
    Live-container probes: exposed endpoints, feature flags, real defaults
  5. Supply chain analysis
    Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
  6. Hardening recommendations
    A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

70 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-78669HIGH7.5
golang.org/x/net
v0.59.0
fixed in 0.60.0
0.6%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-78659HIGH7.5
golang.org/x/net
v0.59.0
fixed in 0.60.0
0.6%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-78669HIGH7.5
stdlib
v1.26.8
fixed in 1.26.9, 1.27.2
0.6%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-78659HIGH7.5
stdlib
v1.26.8
fixed in 1.26.9, 1.27.2
0.6%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-78660MEDIUM6
golang.org/x/net
v0.59.0
fixed in 0.60.0
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-78667MEDIUM6
stdlib
v1.26.8
fixed in 1.26.9, 1.27.2
0.5%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-97031MEDIUM6
stdlib
v1.26.8
fixed in 1.26.9, 1.27.2
0.5%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-78660MEDIUM6
stdlib
v1.26.8
fixed in 1.26.9, 1.27.2
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-94440MEDIUM6
stdlib
v1.26.8
fixed in 1.26.9, 1.27.2
0.5%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-97032MEDIUM5.9
golang.org/x/net
v0.59.0
fixed in 0.60.0
0.5%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-97032MEDIUM5.9
stdlib
v1.26.8
fixed in 1.26.9, 1.27.2
0.5%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-111943MEDIUM5.44
stdlib
v1.26.8
fixed in 1.26.10, 1.27.3
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-78663MEDIUM5.3
golang.org/x/net
v0.59.0
fixed in 0.60.0
0.6%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-78663MEDIUM5.3
stdlib
v1.26.8
fixed in 1.26.9, 1.27.2
0.6%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-94439MEDIUM5.2
stdlib
v1.26.8
fixed in 1.26.9, 1.27.2
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
GO-2026-5932MEDIUM4
golang.org/x/crypto
v0.57.0
No fix yet
—
Directly Exposed
CVE-2026-56866LOW3.9
stdlib
v1.26.8
fixed in 1.26.9, 1.27.2
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-111497LOW3.79
brotli-libs
1.2.0-r0
fixed in 1.2.1-r0
82.6%
Actively Exploited
Post-Exploit
CVE-2026-94448LOW3.66
stdlib
v1.26.8
fixed in 1.26.9, 1.27.2
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-97030LOW3.66
stdlib
v1.26.8
fixed in 1.26.9, 1.27.2
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-56857LOW3.3
stdlib
v1.26.8
fixed in 1.26.9, 1.27.2
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-92392LOW2.92
curl
8.22.0-r0
fixed in 8.23.0-r0
1.3%
Low-Moderate Risk
Post-Exploit
CVE-2026-92392LOW2.92
libcurl
8.22.0-r0
fixed in 8.23.0-r0
1.3%
Low-Moderate Risk
Post-Exploit
CVE-2026-114437LOW2.88
github.com/go-chi/chi/v5
v5.3.2
fixed in 5.4.0
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-86410LOW2.45
curl
8.22.0-r0
fixed in 8.23.0-r0
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-86410LOW2.45
libcurl
8.22.0-r0
fixed in 8.23.0-r0
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-92388LOW2.34
curl
8.22.0-r0
fixed in 8.23.0-r0
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-86414LOW2.34
curl
8.22.0-r0
fixed in 8.23.0-r0
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-92390LOW2.34
curl
8.22.0-r0
fixed in 8.23.0-r0
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-92388LOW2.34
libcurl
8.22.0-r0
fixed in 8.23.0-r0
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-86414LOW2.34
libcurl
8.22.0-r0
fixed in 8.23.0-r0
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-92390LOW2.34
libcurl
8.22.0-r0
fixed in 8.23.0-r0
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-86411LOW2.12
curl
8.22.0-r0
fixed in 8.23.0-r0
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-86411LOW2.12
libcurl
8.22.0-r0
fixed in 8.23.0-r0
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-86409LOW1.91
curl
8.22.0-r0
fixed in 8.23.0-r0
1.1%
Low-Moderate Risk
Post-Exploit
CVE-2026-86412LOW1.91
curl
8.22.0-r0
fixed in 8.23.0-r0
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-86413LOW1.91
curl
8.22.0-r0
fixed in 8.23.0-r0
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-86409LOW1.91
libcurl
8.22.0-r0
fixed in 8.23.0-r0
1.1%
Low-Moderate Risk
Post-Exploit
CVE-2026-86412LOW1.91
libcurl
8.22.0-r0
fixed in 8.23.0-r0
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-86413LOW1.91
libcurl
8.22.0-r0
fixed in 8.23.0-r0
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-107928LOW1.73
curl
8.22.0-r0
fixed in 8.23.0-r0
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-107928LOW1.73
libcurl
8.22.0-r0
fixed in 8.23.0-r0
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-92386LOW1.55
curl
8.22.0-r0
fixed in 8.23.0-r0
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-92386LOW1.55
libcurl
8.22.0-r0
fixed in 8.23.0-r0
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-107929LOW1.33
curl
8.22.0-r0
fixed in 8.23.0-r0
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-86415LOW1.33
curl
8.22.0-r0
fixed in 8.23.0-r0
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-87861LOW1.33
curl
8.22.0-r0
fixed in 8.23.0-r0
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-87862LOW1.33
curl
8.22.0-r0
fixed in 8.23.0-r0
1.0%
Theoretical Threat
Post-Exploit
CVE-2026-87863LOW1.33
curl
8.22.0-r0
fixed in 8.23.0-r0
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-87864LOW1.33
curl
8.22.0-r0
fixed in 8.23.0-r0
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-87865LOW1.33
curl
8.22.0-r0
fixed in 8.23.0-r0
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-87866LOW1.33
curl
8.22.0-r0
fixed in 8.23.0-r0
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-92387LOW1.33
curl
8.22.0-r0
fixed in 8.23.0-r0
1.0%
Low-Moderate Risk
Post-Exploit
CVE-2026-92389LOW1.33
curl
8.22.0-r0
fixed in 8.23.0-r0
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-92391LOW1.33
curl
8.22.0-r0
fixed in 8.23.0-r0
1.2%
Low-Moderate Risk
Post-Exploit
CVE-2026-107929LOW1.33
libcurl
8.22.0-r0
fixed in 8.23.0-r0
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-86415LOW1.33
libcurl
8.22.0-r0
fixed in 8.23.0-r0
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-87861LOW1.33
libcurl
8.22.0-r0
fixed in 8.23.0-r0
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-87862LOW1.33
libcurl
8.22.0-r0
fixed in 8.23.0-r0
1.0%
Theoretical Threat
Post-Exploit
CVE-2026-87863LOW1.33
libcurl
8.22.0-r0
fixed in 8.23.0-r0
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-87864LOW1.33
libcurl
8.22.0-r0
fixed in 8.23.0-r0
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-87865LOW1.33
libcurl
8.22.0-r0
fixed in 8.23.0-r0
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-87866LOW1.33
libcurl
8.22.0-r0
fixed in 8.23.0-r0
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-92387LOW1.33
libcurl
8.22.0-r0
fixed in 8.23.0-r0
1.0%
Low-Moderate Risk
Post-Exploit
CVE-2026-92389LOW1.33
libcurl
8.22.0-r0
fixed in 8.23.0-r0
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-92391LOW1.33
libcurl
8.22.0-r0
fixed in 8.23.0-r0
1.2%
Low-Moderate Risk
Post-Exploit
CVE-2026-94266LOW1.19
curl
8.22.0-r0
fixed in 8.23.0-r0
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-94266LOW1.19
libcurl
8.22.0-r0
fixed in 8.23.0-r0
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-94265LOW1.12
curl
8.22.0-r0
fixed in 8.23.0-r0
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-94265LOW1.12
libcurl
8.22.0-r0
fixed in 8.23.0-r0
0.8%
Theoretical Threat
Post-Exploit

Want to check another image? Run a full scan with the Docker Security Scanner.