Improper input validation in Caddyserver Caddy
CVE-2026-27590
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the ori…
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.002 (48.0th percentile) — read the EPSS interpretation.
Affected products
- Caddyserver Caddy — versions < 2.11.1
Weakness classification (CWE)
References
- https://github.com/caddyserver/caddy/security/advisories/GHSA-5r3v-vc8m-m96g (x_refsource_CONFIRM)
- https://github.com/php/frankenphp/security/advisories/GHSA-g966-83w7-6w38 (x_refsource_MISC)
- https://github.com/caddyserver/caddy/releases/tag/v2.11.1 (x_refsource_MISC)