CVE-2026-27588CWE-178

Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass

High · published February 24, 2026

CVSS v4.0
7.7
EPSS
1%
Percentile
48.2
In the wild
Unconfirmed
What it is

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request matcher is documented as case-insensitive, but when configured with a large host list (>100 entries) it becomes case-sensitive due to an optimized matching path. An attacker can bypass host-based routing and any access controls attached to that route by changing the casing of the `Host` header. Version 2.11.1 contains a fix for the issue.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00604 · 48.2th percentile
Weakness
CWE-178 · Improper Handling of Case Sensitivity
Published
2026-02-24T16:28Z
EPSS history
Timeline
  • 24 FEB 16:28Z
    Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass
    cvelistv5