Caddy Server EUVD-2026-85514

Exploitation requires that the Caddy site configuration resolves the http.request.body placeholder (e.g. referenced in a directive/Caddyfile that runs through the replacer) so that modules/caddyhttp/replacer.go reads the full body via unbounded io.Copy before request-body size-limit middleware applies; this is NOT a default Caddy configuration. Given that config, no authentication or user interaction is needed - any remote client can send large or streamed request bodies. The primary limiting factor is this operator-config prerequisite; without a config path that resolves http.request.body, the vulnerable code is not reached. Impact is limited to availability (memory exhaustion / process termination) with no data exposure.

This is a genuine but bounded availability-only issue, not a high-severity emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:L, 6.9) reflects a network-reachable, unauthenticated, low-complexity DoS with only limited availability impact and zero confidentiality/integrity impact - consistent with the description (memory exhaustion → process termination). No EPSS score, no CISA KEV listing, and no independent SSVC decision data were provided, so there is no evidence of active exploitation or automatability from the input. The single most important qualifier is a deployment condition the CVSS vector does not capture: exploitation only works if the operator's Caddy configuration actually references the http.request.body placeholder (resolved in modules/caddyhttp/replacer.go), which is not a default configuration. Therefore the PR:N/AV:N metrics correctly describe the attacker (any remote unauthenticated client) but overstate real-world exposure, because most Caddy deployments never resolve http.request.body. Treat this as a medium-priority patch for sites that use the placeholder and as low priority otherwise.

An attacker sends HTTP requests with very large or slowly-streamed request bodies to a Caddy 2.11.3-or-earlier instance whose config references the http.request.body placeholder; the replacer performs an unbounded io.Copy of the entire body into memory before request-body size limits are applied, driving memory exhaustion and terminating the process. The bundling advisory (GHSA-j8px-rmrx-76h9) states all three issues were reproduced end-to-end against the unmodified official caddy:2.11.3 Docker image, so reproduction methodology is publicly documented, though a turnkey weaponized exploit is not confirmed in the input.