CVE-2026-92284
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and process termination.
Risk Assessment
An attacker can send a request with a large body, causing memory exhaustion and termination of the Caddy process, leading to denial of service. This affects server availability.
Recommendation
Update Caddy to a version later than 2.11.3 that contains the fix for this vulnerability. If updating is not possible, consider limiting request body size at the server level or using an external proxy to filter large requests.
Other vulnerabilities in Caddy
See all- CVE-2026-92700Medium
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden() uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths coexist and expose files intended to be hidden.
- CVE-2026-77281Medium
Caddy in version 2.11.3 and earlier has three configuration-dependent weaknesses affecting the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite() can pass attacker-controlled replacement bytes through buildQueryString for a second placeholder expansion when a rewrite URI ends with a literal question mark, allowing injected environment or request-variable placeholders to disclose data and, when the file provider is registered, allowing injected file placeholders to disclose readable files. The issue is fixed in version 2.11.4.
- CVE-2026-52846Medium
Caddy before version 2.11.4 has a vulnerability in the stripHTML template function that cannot reliably remove all HTML tags from input strings. Malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output.
- CVE-2026-52845High
Caddy before version 2.11.4 has a vulnerability in the forward_auth copy_headers mechanism that allows a remote client to bypass identity header deletion and inject its own header into CGI/PHP-FastCGI. The issue arises from a difference in HTTP header normalization (replacing hyphens with underscores) between Caddy and PHP/FastCGI.
- CVE-2026-52844High
Caddy before version 2.11.4 on Windows incorrectly handles path separators in path matchers, allowing bypass of access controls to protected directories. An unauthenticated remote attacker can access protected resources.
Original NVD description (English source)
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and process termination.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS