PT-2026-21772 · Caddy · Caddy

Manizada · Published 2026-01-01 · Updated 2026-03-03 · CVE-2026-27587

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Caddy versions prior to 2.11.1

Description Caddy’s HTTP path request matcher is intended to be case-insensitive, but when the match pattern contains percent-escape sequences (%xx) it compares against the request's escaped path without lowercasing. This can allow an attacker to bypass path-based routing and any access controls attached to that route by changing the casing of the request path. The issue occurs because r.URL.EscapedPath() is not lowercased, leading to case differences in the request path causing the escaped-space match to fail even though MatchPath is meant to be case-insensitive. An attacker can bypass route restrictions by changing the casing of the request path.

Recommendations Update to Caddy version 2.11.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-178

Related Identifiers

CVE-2026-27587

GHSA-G7PC-PC7G-H8JH

GO-2026-4538

SUSE-SU-2026:0757-1

Affected Products

Caddy

References · 125

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27587.json · Exploit
• https://github.com/caddyserver/caddy/security/advisories/GHSA-g7pc-pc7g-h8jh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27587 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27587 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27587 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27587 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-27587 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g7pc-pc7g-h8jh · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-27587 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4538 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27587 · Security Note
• https://github.com/caddyserver/caddy · Note
• https://github.com/caddyserver/caddy/releases/tag/v2.11.1 · Note
• https://github.com/caddyserver/caddy/commit/a1081194bfae4e0d8c227ec44aecb95eded55d1e · Note