CVE-2026-27587 Details
Description
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request matcher is intended to be case-insensitive, but when the match pattern contains percent-escape sequences (`%xx`) it compares against the request's escaped path without lowercasing. An attacker can bypass path-based routing and any access controls attached to that route by changing the casing of the request path. Version 2.11.1 contains a fix for the issue.
A path-based routing and access control bypass vulnerability has been identified in Caddy versions prior to 2.11.1. The issue arises in the HTTP 'path' request matcher, which is supposed to be case-insensitive. However, when the match pattern includes percent-escape sequences, it compares the request's escaped path without converting it to lowercase. This oversight allows attackers to manipulate the casing of the request path, bypassing routing and access controls. The vulnerability is present in Caddy's HTTP module, specifically in version 2.10.2.
Users can upgrade to Caddy version 2.11.1, which addresses this vulnerability by ensuring that the matching process for percent-escaped paths is properly normalized to be case-insensitive.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/caddyserver/caddy/releases/tag/v2.11.1 | [email protected] | Release Notes |
| https://github.com/caddyserver/caddy/security/advisories/GHSA-g7pc-pc7g-h8jh | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-178 | Improper Handling of Case Sensitivity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| caddyserver caddy | >= 2.10.2, < 2.11.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 25, 2026 | Initial Analysis | [email protected] |
| Feb 24, 2026 | New CVE Received | [email protected] |