PT-2026-21773 · Caddy · Caddy

Manizada · Published 2026-01-01 · Updated 2026-03-03 · CVE-2026-27588

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Caddy versions prior to 2.11.1

Description Caddy’s HTTP host request matcher is documented as case-insensitive, but becomes case-sensitive when configured with a large host list (more than 100 entries) due to an optimized matching path. An attacker can bypass host-based routing and any access controls associated with that route by altering the casing of the Host header. This is a route/auth bypass in Caddy’s request-matching layer. Internet-exposed Caddy deployments relying on host matchers with large host lists to protect routes can be bypassed by changing the case of the Host header, potentially allowing unauthorized access to sensitive endpoints. The affected component is the MatchHost matcher, specifically the MatchHost.MatchWithError function. The vulnerability occurs because the matcher uses a case-sensitive string comparison when the host list exceeds 100 entries. The Host header is a standard HTTP request header used to identify the requested resource.

Recommendations Update to Caddy version 2.11.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-178

Related Identifiers

CVE-2026-27588

GHSA-X76F-JF84-RQJ8

GO-2026-4541

SUSE-SU-2026:0757-1

Affected Products

Caddy

References · 126

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27588.json · Exploit
• https://github.com/caddyserver/caddy/security/advisories/GHSA-x76f-jf84-rqj8 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-27588 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27588 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27588 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27588 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27588 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27588 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x76f-jf84-rqj8 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-27588 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4541 · Vendor Advisory
• https://github.com/caddyserver/caddy · Note
• https://github.com/caddyserver/caddy/releases/tag/v2.11.1 · Note
• https://github.com/caddyserver/caddy/commit/eec32a0bb5a11651c6a7b04ce82dc50610f2b27e · Note