7.7
High
CVE-2026-27588 Caddy is an extensible server platform that uses TLS by default
Description
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request matcher is documented as case-insensitive, but when configured with a large host list (>100 entries) it becomes case-sensitive due to an optimized matching path. An attacker can bypass host-based routing and any access controls attached to that route by changing the casing of the `Host` header. Version 2.11.1 contains a fix for the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| caddy 2.11 | earliest → < 2.11.1 | 2.11.1 |
Other CVEs of caddy
The 17 CVEs of caddy →
CVE-2026-55458
Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
2.9
Low
CVE-2026-92700
Caddy is an extensible server platform that uses TLS by default
6.3
Medium
CVE-2026-92284
Caddy is an extensible server platform that uses TLS by default
6.9
Medium
CVE-2026-77281
Caddy is an extensible server platform that uses TLS by default
6.5
Medium