Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request matcher is intended to be case-insensitive, but when the match pattern contains percent-escape sequences (`%xx`) it compares against the request's escaped path without lowercasing. An attacker can bypass path-based routing and any access controls attached to that route by changing the casing of the request path. Version 2.11.1 contains a fix for the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-24 | 1 | Disclosure1 |
| 2026-02-25 | 2 | Disclosure2 |
CVE-2026-27587 Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request matcher is intended to be case-insensitive, but … https://www.cve.org/CVERecord?id=CVE-2026-27587
Post summary
The post announces a case‑sensitivity flaw in Caddy’s HTTP path matcher before v2.11.1, as documented in CVE‑2026‑27587.
CVE-2026-27587: Caddy Shack: Bypassing ACLs with a Caps Lock Key A logic error in Caddy's HTTP path matching engine allows attackers to bypass access control lists (ACLs) by manipulating URL casing. When a configuration pattern involves percent-encode... https://cvereports.com/reports/CVE-2026-27587
Post summary
The report details a logic flaw in Caddy’s HTTP path matching that lets attackers bypass ACLs by altering URL casing and percent-encoding.
CVE-2026-27587 Path Traversal Bypass in Caddy Web Server Prior to Version 2.11.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27587
Post summary
A path traversal bypass vulnerability (CVE-2026-27587) affecting Caddy Web Server versions prior to 2.11.1 has been disclosed, with no PoC, exploit, or patch details provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | caddyserver | caddy | - | - | - |