Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass
Priority HIGH 73CWE-178Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request matcher is documented as case-insensitive, but when configured with a large host list (>100 entries) it becomes case-sensitive due to an optimized matching path. An attacker can bypass host-based routing and any access controls attached to that route by changing the casing of the `Host` header. Version 2.11.1 contains a fix for the issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00425 36th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed caddy (caddyserver): 2.11.1github.com/caddyserver/caddy/v2 (Go): 2.11.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| caddyserver | caddy | before 2.11.1 | 2.11.1 | Patch available | CNA |
| — | github.com/caddyserver/caddy/v2 (Go) | before 2.11.1 | 2.11.1 | Patch available | GHSA-x76f-jf84-rqj8 |
- caddy Vendorcaddyserver Affected before 2.11.1 Fixed in 2.11.1 Patch available CNA
- github.com/caddyserver/caddy/v2 (Go) Vendor— Affected before 2.11.1 Fixed in 2.11.1 Patch available GHSA-x76f-jf84-rqj8
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:* | 2.10.2 to before 2.11.1 | Vulnerable | caddyserver |
- cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:* Versions 2.10.2 to before 2.11.1 Vulnerable ·caddyserver
Remediation
- Fix · CNA caddy (caddyserver) Fixed in 2.11.1
- Fix · GHSA-x76f-jf84-rqj8 github.com/caddyserver/caddy/v2 (Go) Fixed in 2.11.1 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-27588
- 2026-10-03 Alias added: GHSA-x76f-jf84-rqj8
References
More caddyserver Caddy vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-21978 Improper input validation in caddyserver caddy CVSS 4.0HIGH 8.9
- TI-2026-21974 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed CVSS 4.0HIGH 8.8
- TI-2026-23680 Improper authentication in caddyserver caddy CVSS 3.1HIGH 8.8
- TI-2026-21975 Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass CVSS 4.0HIGH 7.7
- TI-2026-37952 Caddy: Windows `file_server` path authorization bypass via encoded backslash CVSS 3.1HIGH 7.5
Sources
- CVE-2026-27588 · CVE Program
- CVE-2026-27588 · NVD
- FIRST EPSS
- GHSA-x76f-jf84-rqj8 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-27588 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences