Caddy
CVE-2026-27588
CRITICAL
GHSA-x76f-jf84-rqj8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft HTTP request with altered Host header casing
-
ExploitBypass case-sensitive matcher in large host list
-
ExecutionAccess restricted route
-
ImpactExploit downstream access controls
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Case sensitivity handling
|
| Exploitation Conditions | Caddy configured with HTTP host matcher containing >100 entries; host-based routing rules present; default Caddy deployment without case-insensitive matcher override. |
| Impact | CVSS 9.1. Virtual host access controls can be bypassed, potentially exposing admin interfaces or internal sites. |
| Exploit ScenarioDerived | Attacker sends request with Host: ADMIN.example.com instead of admin.example.com, bypassing virtual host routing rules. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Host header case sensitivity bypass in Caddy before 2.11.1. Virtual host routing can be bypassed by using alternate casing in the Host header. PoC available.
Earlier versions of this analysis (1)
Host header case bypass in Caddy virtual hosting.
RemediationAI
Update to Caddy 2.11.1.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-178 case sensitivity issue in host matching. The HTTP Host header is matched case-sensitively but DNS is case-insensitive.
Know when Caddy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP host request matcher is documented as case-insensitive, but when configured with a large host list (>100 entries) it becomes case-sensitive due to an optimized matching path. An attacker can bypass host-based routing and any access controls attached to that route by changing the casing of the Host header. Version 2.11.1 contains a fix for the issue.
Executive ViewAI
Caddy web servers with large host configurations (>100 entries) are vulnerable to authentication and access control bypass due to case-sensitive host matching inconsistency. Attackers can exploit this to access restricted content or bypass security policies, affecting any organization using Caddy as a reverse proxy, API gateway, or web server with host-based access controls.
Implement WAF rules to force lowercase normalization of Host headers before reaching Caddy; segment affected Caddy servers behind additional authentication layers (mTLS, reverse proxy with strict host validation); disable or minimize host-based access control rules and migrate to alternative authentication methods; monitor logs for case-mismatch anomalies indicating exploitation attempts; consider temporary rollback to smaller host lists or use DNS/load balancer-based routing instead of Caddy host matching.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
FastCGI path splitting vulnerability in Caddy before 2.11.1 allows request smuggling or path confusion when proxying to
TLS error swallowing in Caddy web server before 2.11.1 allows bypassing client certificate authentication. Errors in Cli
Case sensitivity bypass in Caddy web server path matching before 2.11.1. HTTP path matchers can be bypassed using altern
Caddy versions 2.10.0 through 2.11.1 fail to strip client-supplied headers in the forward_auth copy_headers directive, e
Caddy versions 2.7.5 through 2.11.1 contain a template injection vulnerability in the vars_regexp matcher that allows re
An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers
A configuration-gated information-disclosure flaw in Caddy 2.11.3 and earlier allows an unauthenticated remote attacker
Caddy versions prior to 2.11.1 fail to sanitize backslashes in file path matching, allowing attackers to bypass path-bas
Caddy versions prior to 2.11.1 allow unauthenticated cross-origin requests to the admin API when origin enforcement is d
An issue was discovered in caddy (for TYPO3) before 7.2.10. Rated medium severity (CVSS 6.1), this vulnerability is remo
Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumer
Same weakness CWE-178 – Improper Handling of Case Sensitivity
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB