Vulnerability in Caddyserver Caddy
CVE-2026-27587
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request matcher is intended to be case-insensitive, but when the match pattern contains percent-escape sequences (`%xx`) it compa…
EPSS: 0.001 (19.6th percentile) — read the EPSS interpretation.
Affected products
- Caddyserver Caddy — versions < 2.11.1
Weakness classification (CWE)
References
- https://github.com/caddyserver/caddy/security/advisories/GHSA-g7pc-pc7g-h8jh (x_refsource_CONFIRM)
- https://github.com/caddyserver/caddy/releases/tag/v2.11.1 (x_refsource_MISC)