CVE-2026-27587
Critical · 9.1CVSS
9.1
EPSS
0.6%
Published
Feb 24, 2026
CISA due date
—
The record
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request matcher is intended to be case-insensitive, but when the match pattern contains percent-escape sequences (`%xx`) it compares against the request's escaped path without lowercasing. An attacker can bypass path-based routing and any access controls attached to that route by changing the casing of the request path. Version 2.11.1 contains a fix for the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/caddyserver/caddy/v2 | 0 | 2.11.1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260226T182644-150000.1.149.1 |
Related vulnerabilities
- GO-2026-4538 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Same vulnerability
- GO-2026-4535 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Also affects github.com/caddyserver/caddy/v2
- GO-2026-4539 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Also affects github.com/caddyserver/caddy/v2
- GO-2026-4536 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Also affects github.com/caddyserver/caddy/v2
- GO-2026-4537 Caddy is vulnerable to cross-origin config application via local admin API /load in… Also affects github.com/caddyserver/caddy/v2
- GO-2026-4541 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Also affects github.com/caddyserver/caddy/v2
- CVE-2026-27589 Caddy is an extensible server platform that uses TLS by default. Also affects github.com/caddyserver/caddy/v2
- CVE-2026-27588 Caddy is an extensible server platform that uses TLS by default. Also affects github.com/caddyserver/caddy/v2