Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass
Résumé
Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP host request matcher is documented as case-insensitive, but when configured with a large host list (>100 entries) it becomes case-sensitive due to an optimized matching path. An attacker can bypass host-based routing and any access controls attached to that route by changing the casing of the Host header. Version 2.11.1 contains a fix for the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2026-27588 caddy
- Ubuntu UBUNTU-CVE-2026-27588 caddy
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com