Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass
Résumé
Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP path request matcher is intended to be case-insensitive, but when the match pattern contains percent-escape sequences (%xx) it compares against the request's escaped path without lowercasing. An attacker can bypass path-based routing and any access controls attached to that route by changing the casing of the request path. Version 2.11.1 contains a fix for the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2026-27587 caddy
- Ubuntu UBUNTU-CVE-2026-27587 caddy
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com