CVE-2026-27588

Katalog CVE

CVSS 9.1 · Critical EPSS 0,55%

Kerentanan Improper Handling of Case Sensitivity pada caddyserver caddy. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request matcher is documented as case-insensitive, but when configured with a large host list (>100 entries) it becomes case-sensitive due to an optimized matching path. An attacker can bypass host-based routing and any access controls attached to that route by changing the casing of the `Host` header. Version 2.11.1 contains a fix for the issue.

Rincian

Terbit di NVD

24 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-178: Improper Handling of Case Sensitivity

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/caddyserver/caddy/security/advisories/GHSA-x76f-jf84-rqj8 exploit · advisory vendor
• https://github.com/caddyserver/caddy/releases/tag/v2.11.1 release notes