CVE-2026-27588: Caddy: host matcher case-sensitivity bypass with large host lists
Caddy's HTTP host matcher is documented as case-insensitive, but with more than 100 host entries it becomes case-sensitive, which can let a request bypass host-based routing and access controls on the affected route. The record rates it critical with CVSS 3.1 9.1 from NVD and 7.7 under CVSS 4.0 from GitHub. The fix is in version 2.11.1, and no confirmed exploitation appears in the sources consulted.
Overview
Caddy is an extensible server platform that uses TLS by default. According to the record, its HTTP host request matcher is documented as case-insensitive, but when configured with more than 100 host entries it behaves as case-sensitive because of an optimized matching path. The issue is tracked as CVE-2026-27588 and classified under CWE-178.
Impact
The record states that an attacker can bypass host-based routing and any access controls attached to the affected route by changing the letter casing of the Host header. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, which indicates network access, low complexity, no privileges and no user interaction, with high confidentiality and integrity impact and no availability impact.
Affected products and versions
- Product listed in the record: Caddyserver Caddy.
- Affected range: from 2.10.2 up to before 2.11.1, and the record also lists a condition of before 2.11.1.
- Fixed in: 2.11.1, per the description and the release reference.
The record's fixes field is empty, so the fix is identified from the description and the release tag rather than a structured fix entry.
Exploitation status
The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation is reported in the sources consulted. The SSVC fields in the record mark exploitation as poc and automatable as yes, and the EPSS probability is 0.00604. The GitHub advisory reference carries an Exploit tag in the record metadata, but that tag does not by itself confirm exploitation in the wild.
Remediation and mitigation
- Upgrade Caddy to version 2.11.1 or later, which the record identifies as the version containing the fix.
- Review whether any route relies only on the host matcher to restrict access, and add defense in depth such as authentication at the application layer.
- The record does not describe a vendor-confirmed workaround. Any configuration change to the host list size should be validated with the vendor before relying on it.
Detection guidance
- Review access logs for requests to protected routes whose Host header casing differs from the configured host names.
- Correlate unexpected access to restricted routes with Host header variations at a high level, without building test payloads from this record.
Limitations of the available information
The record does not include the vendor's detailed technical description of the optimized matching path, a CWE name, or a structured fixed-version entry. The GitHub CVSS 4.0 score of 7.7 differs from the NVD CVSS 3.1 score of 9.1, and the record does not explain the difference. The EPSS date in the record should be treated as provided by the data source without independent verification.
Frequently asked questions
What is the core problem in CVE-2026-27588?
According to the record, Caddy's host matcher is documented as case-insensitive but becomes case-sensitive when configured with more than 100 host entries, which can let requests bypass host-based routing and access controls.
Which version fixes the issue?
The record identifies version 2.11.1 as containing the fix. Versions from 2.10.2 up to before 2.11.1 are listed as affected.
Is this vulnerability known to be exploited in the wild?
No. The CISA KEV catalog does not list it in the record, and no confirmed active exploitation appears in the sources consulted.
Why do the CVSS scores differ?
The record shows NVD CVSS 3.1 at 9.1 and GitHub CVSS 4.0 at 7.7. The record does not explain the difference between the two assessments.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.