CVE-2026-27588

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-27588 affects Caddy, an extensible server platform that uses TLS by default, in versions prior to 2.11.1. The vulnerability stems from the HTTP `host` request matcher, which is documented as case-insensitive but becomes case-sensitive when configured with a large host list exceeding 100 entries due to an optimized matching path. This inconsistency, classified under CWE-178 (Improper Handling of Case Sensitivity), enables attackers to bypass host-based routing and associated access controls by manipulating the casing of the `Host` header. The issue carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity with high impacts on confidentiality and integrity.

Any unauthenticated remote attacker with network access can exploit this vulnerability by crafting HTTP requests with altered casing in the `Host` header, such as changing "example.com" to "Example.com" when the configuration expects a specific case. This allows evasion of intended routing logic, potentially granting access to restricted routes, sensitive endpoints, or resources protected by host-specific access controls. Exploitation requires no privileges, user interaction, or special conditions beyond a large host list in the Caddy configuration, making it straightforward in misconfigured deployments.

The Caddy security advisory (GHSA-x76f-jf84-rqj8) and release notes for version 2.11.1 detail the fix, which restores consistent case-insensitive matching regardless of host list size. Security practitioners should upgrade to Caddy 2.11.1 or later to mitigate the issue, review configurations with large host lists for exposure, and monitor `Host` header patterns in access logs for signs of bypass attempts.