Vulnerability in Caddyserver Caddy
CVE-2026-27588
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request matcher is documented as case-insensitive, but when configured with a large host list (>100 entries) it becomes case-sens…
EPSS: 0.001 (19.6th percentile) — read the EPSS interpretation.
Affected products
- Caddyserver Caddy — versions < 2.11.1
Weakness classification (CWE)
References
- https://github.com/caddyserver/caddy/security/advisories/GHSA-x76f-jf84-rqj8 (x_refsource_CONFIRM)
- https://github.com/caddyserver/caddy/releases/tag/v2.11.1 (x_refsource_MISC)