Read the docs
TI-2026-85642 Aliases CVE-2026-55458

Caddy leaks hop-by-hop headers through WebSocket upgrade responses

Priority LOW 15CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Caddy before 2.11.5 is affected in its reverse proxy. A flaw in how it handles upstream 101 Switching Protocols responses (CWE-444) lets hop-by-hop headers pass through the proxy to clients. An attacker who controls or compromises a proxied WebSocket upstream can leak headers such as Alt-Svc, Keep-Alive, and Proxy-Authenticate, as well as headers named by Connection.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.5, the reverse proxy's finalizeResponse method in modules/caddyhttp/reverseproxy/reverseproxy.go handles an upstream 101 Switching Protocols response before running removeConnectionHeaders and the hopHeaders deletion loop used for ordinary responses. The early return invokes handleUpgradeResponse, which copies the upstream headers to the client and normalizes only WebSocket-specific header names. An attacker who controls or compromises a proxied WebSocket upstream can therefore cause hop-by-hop headers such as Alt-Svc, Keep-Alive, and Proxy-Authenticate, as well as headers named by Connection, to cross the proxy boundary. For HTTP/2 or HTTP/3 extended CONNECT, the upstream 101 response may be represented to the client as an ordinary successful response, increasing the chance that leaked headers are processed. This issue is fixed in version 2.11.5.

Why it matters now

EPSS 0.00499 43rd percentileScored 2026-11-07
Fix Fixed caddy (caddyserver): 2.11.5github.com/caddyserver/caddy/v2 (Go): 2.11.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
caddyservercaddybefore 2.11.52.11.5Patch availableCNA
—github.com/caddyserver/caddy/v2 (Go)before 2.11.52.11.5Patch availableGHSA-8qx7-j2v2-x6q5
  • caddy Vendorcaddyserver Affected before 2.11.5 Fixed in 2.11.5 Patch available CNA
  • github.com/caddyserver/caddy/v2 (Go) Vendor— Affected before 2.11.5 Fixed in 2.11.5 Patch available GHSA-8qx7-j2v2-x6q5

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*——caddyserver
  • cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:* Versions — — ·caddyserver

Remediation

Upgrade Caddy to version 2.11.5, which is the fixed version for both the caddy product and the Go module github.com/caddyserver/caddy/v2. Red Hat lists one product as not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA caddy (caddyserver) Fixed in 2.11.5
  • Fix · GHSA-8qx7-j2v2-x6q5 github.com/caddyserver/caddy/v2 (Go) Fixed in 2.11.5 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-55458
  2. 2026-11-07 Affected versions changed · Red Hat
  3. 2026-11-07 CVSS score added · Red Hat

References

Other 4

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-21978 Improper input validation in caddyserver caddy CVSS 4.0HIGH 8.9
  • TI-2026-21974 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed CVSS 4.0HIGH 8.8
  • TI-2026-23680 Improper authentication in caddyserver caddy CVSS 3.1HIGH 8.8
  • TI-2026-21976 Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass CVSS 4.0HIGH 7.7
  • TI-2026-21975 Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass CVSS 4.0HIGH 7.7
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences