CVE-2026-92284 Details
Description
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and process termination.
A denial-of-service vulnerability has been identified in Caddy versions through 2.11.3. The issue arises in the HTTP replacer module, where the placeholder `{http.request.body}` is resolved without any size limits. This unbounded reading of the request body into memory can lead to memory exhaustion and process termination, especially if the Caddy instance is running with restricted memory limits.
Users can update to Caddy version 2.11.4, where this vulnerability has been patched. The patch involves wrapping the body read in the replacer module with a limit reader to prevent unbounded memory allocation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026CISA-ADP
Assessed Sep 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9 | CISA-ADP | AdvisoryBundleExploitRemedyTechnical AnalysisVendor |
| https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9 | [email protected] | AdvisoryBundleExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Caddy | <= 2.11.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 23, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2026 | New CVE Received | [email protected] |