Sign-up

ID

VAR-202602-3216


CVE

CVE-2026-27588


TITLE

Light Code Labs of Caddy Vulnerability in improper handling of uppercase and lowercase letters in

Trust: 0.8

sources: JVNDB: JVNDB-2026-005158

DESCRIPTION

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request matcher is documented as case-insensitive, but when configured with a large host list (>100 entries) it becomes case-sensitive due to an optimized matching path. An attacker can bypass host-based routing and any access controls attached to that route by changing the casing of the `Host` header. Version 2.11.1 contains a fix for the issue. This issue is fixed in version 2.11.1 has been fixed.All information handled by the software may be leaked to the outside. All information handled by the software may be rewritten. Furthermore, the software will not stop. Furthermore, attacks that exploit this vulnerability will not affect other software

Trust: 1.62

sources: NVD: CVE-2026-27588 // JVNDB: JVNDB-2026-005158

AFFECTED PRODUCTS

vendor:caddyservermodel:caddyscope:ltversion:2.11.1

Trust: 1.0

vendor:caddyservermodel:caddyscope:gteversion:2.10.2

Trust: 1.0

vendor:light codemodel:caddyscope:eqversion:2.10.2 that's all 2.11.1

Trust: 0.8

vendor:light codemodel:caddyscope: - version: -

Trust: 0.8

vendor:light codemodel:caddyscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2026-005158 // NVD: CVE-2026-27588

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2026-27588
value: CRITICAL

Trust: 1.0

security-advisories@github.com: CVE-2026-27588
value: HIGH

Trust: 1.0

NVD: CVE-2026-27588
value: CRITICAL

Trust: 0.8

nvd@nist.gov: CVE-2026-27588
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 5.2
version: 3.1

Trust: 1.0

NVD: CVE-2026-27588
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2026-005158 // NVD: CVE-2026-27588 // NVD: CVE-2026-27588

PROBLEMTYPE DATA

problemtype:CWE-178

Trust: 1.0

problemtype:Improper case sensitivity (CWE-178) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2026-005158 // NVD: CVE-2026-27588

PATCH

title:Caddyurl:https://github.com/caddyserver/caddy/security/advisories/GHSA-x76f-jf84-rqj8

Trust: 0.8

sources: JVNDB: JVNDB-2026-005158

EXTERNAL IDS

db:NVDid:CVE-2026-27588

Trust: 2.6

db:JVNDBid:JVNDB-2026-005158

Trust: 0.8

sources: JVNDB: JVNDB-2026-005158 // NVD: CVE-2026-27588

REFERENCES

url:https://github.com/caddyserver/caddy/releases/tag/v2.11.1

Trust: 1.8

url:https://github.com/caddyserver/caddy/security/advisories/ghsa-x76f-jf84-rqj8

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2026-27588

Trust: 0.8

sources: JVNDB: JVNDB-2026-005158 // NVD: CVE-2026-27588

SOURCES

db:JVNDBid:JVNDB-2026-005158
db:NVDid:CVE-2026-27588

LAST UPDATE DATE

2026-03-03T23:25:23.865000+00:00


SOURCES UPDATE DATE

db:JVNDBid:JVNDB-2026-005158date:2026-02-27T03:42:00
db:NVDid:CVE-2026-27588date:2026-02-25T17:10:48.980

SOURCES RELEASE DATE

db:JVNDBid:JVNDB-2026-005158date:2026-02-27T00:00:00
db:NVDid:CVE-2026-27588date:2026-02-24T17:29:04.163