caddyserver/caddy

Scanned on Jun 21, 2026

Risk score/ 100

Moderate risk

Summary

Caddy server uses quantum-vulnerable ECDSA (P-256) for ACME certificate operations and MD5 hashing in FastCGI testing. While most findings are in test code, the ACME integration tests demonstrate patterns likely used in production certificate management, posing moderate post-quantum risks to TLS infrastructure.

Critical

High

Medium

Low

Top findings

CriticalMD5
modules/caddyhttp/reverseproxy/fastcgi/client_test.go:70
SHA3-256 or SHA-256
Raw evidence
```
h := md5.New()
```
CriticalMD5
modules/caddyhttp/reverseproxy/fastcgi/client_test.go:94
SHA3-256 or SHA-256
Raw evidence
```
h := md5.New()
```
CriticalMD5
modules/caddyhttp/reverseproxy/fastcgi/client_test.go:102
SHA3-256 or SHA-256
Raw evidence
```
md5 := fmt.Sprintf("%x", h.Sum(nil))
```
CriticalMD5
modules/caddyhttp/reverseproxy/fastcgi/client_test.go:105
SHA3-256 or SHA-256
Raw evidence
```
if kn != md5 {
```
CriticalMD5
modules/caddyhttp/reverseproxy/fastcgi/client_test.go:106
SHA3-256 or SHA-256
Raw evidence
```
fmt.Fprintln(resp, "server:err ", md5, kn)
```

+ 16 more findings in the full report

Scan your own repository

Free. Results in ~90 seconds. CBOM + DORA/NIS2 PDF included.

Start a free scan