GO-2026-4536
NoneCVSS
—
EPSS
—
Published
Feb 26, 2026
CISA due date
—
The record
Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/caddyserver/caddy/v2 | 0 | 2.11.1 |
Related vulnerabilities
- CVE-2026-27590 Caddy is an extensible server platform that uses TLS by default. Same vulnerability
- GO-2026-4535 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Also affects github.com/caddyserver/caddy/v2
- GO-2026-4539 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Also affects github.com/caddyserver/caddy/v2
- GO-2026-4537 Caddy is vulnerable to cross-origin config application via local admin API /load in… Also affects github.com/caddyserver/caddy/v2
- GO-2026-4541 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Also affects github.com/caddyserver/caddy/v2
- GO-2026-4538 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Also affects github.com/caddyserver/caddy/v2
- CVE-2026-27589 Caddy is an extensible server platform that uses TLS by default. Also affects github.com/caddyserver/caddy/v2
- CVE-2026-27588 Caddy is an extensible server platform that uses TLS by default. Also affects github.com/caddyserver/caddy/v2