7.7
Élevée
CVE-2026-27587 Caddy is an extensible server platform that uses TLS by default
Description
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request matcher is intended to be case-insensitive, but when the match pattern contains percent-escape sequences (`%xx`) it compares against the request's escaped path without lowercasing. An attacker can bypass path-based routing and any access controls attached to that route by changing the casing of the request path. Version 2.11.1 contains a fix for the issue.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| caddy 2.11 | premières → < 2.11.1 | 2.11.1 |
Références
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de caddy
Les 17 CVE de caddy →
CVE-2026-55458
Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
2.9
Faible
CVE-2026-92700
Caddy is an extensible server platform that uses TLS by default
6.3
Moyenne
CVE-2026-92284
Caddy is an extensible server platform that uses TLS by default
6.9
Moyenne
CVE-2026-77281
Caddy is an extensible server platform that uses TLS by default
6.5
Moyenne