CVE-2026-27588Disclosure(caddyserver / caddy)

Caddy is a top trending GitHub project for the day, an extensible multi-platform HTTP/1-2-3 server written in Go that serves TLS by default with no external dependencies. It matters now because CVE-2026-27588 is an authorization bypass vulnerability in the Caddy web server platform: the HTTP host request matcher is documented as case-insensitive but becomes case-sensitive when configured with a host list of more than 100 entries due to an optimized matching path. A short Caddyfile can put a site or API in production with HTTPS and a reverse proxy, and the project itself says it is production-ready after trillions of requests with no external dependencies. https://github.com/caddyserver/caddy

🔴 CVE-2026-27588 - Critical Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request matcher is documented as case-insensitive, but when configured with a... https://www.thehackerwire.com/vulnerability/CVE-2026-27588/ https://t.co/k7EwNRJgqh

CVE-2026-27588 Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request matcher is documented as case-insensitive, but w… https://www.cve.org/CVERecord?id=CVE-2026-27588

CVE-2026-27588: Case Sensitive Chaos: Bypassing Caddy Authentication with a Shift Key A logic error in Caddy's HTTP host matcher allows attackers to bypass routing rules and associated security middleware (like authentication) by simply changing the c... https://cvereports.com/reports/CVE-2026-27588

CVE-2026-27588 Host Header Case Sensitivity Bypass in Caddy Web Server Before 2.11.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27588