Most recent entries from all

EUVD-2026-273769

2026-10-03T10:52:41.259073+00:00

EUVD-2026-273769

fkie_cve-2026-27587

2026-10-03T10:52:41.259137+00:00

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request matcher is intended to be case-insensitive, but when the match pattern contains percent-escape sequences (`%xx`) it compares against the request's escaped path without lowercasing. An attacker can bypass path-based routing and any access controls attached to that route by changing the casing of the request path. Version 2.11.1 contains a fix for the issue.

GHSA-g7pc-pc7g-h8jh — Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass

2026-10-03T10:52:41.259197+00:00

Affected: Go: github.com/caddyserver/caddy/v2

### Summary Caddy's HTTP `path` request matcher is intended to be case-insensitive, but when the match pattern contains percent-escape sequences (`%xx`) it compares against the request's escaped path without lowercasing. An attacker can bypass path-based routing and any access controls attached to that route by changing the casing of the request path.

### Details In Caddy `v2.10.2`, `MatchPath` is explicitly designed to be case-insensitive and lowercases match patterns during provisioning:

- `modules/caddyhttp/matchers.go`: rationale captured in the `MatchPath` comment. - `MatchPath.Provision` lowercases configured patterns via `strings.ToLower`. - `MatchPath.MatchWithError` lowercases the request path for the normal matching path: `reqPath := strings.ToLower(r.URL.Path)`.

But when a match pattern contains a percent sign (`%`), `MatchPath.MatchWithError` switches to "escaped space" matching and builds the comparison string from `r.URL.EscapedPath()`:

- `reqPathForPattern := CleanPath(r.URL.EscapedPath(), mergeSlashes)` - If it doesn't match, it `continue`s (skipping the remaining matching logic for that pattern).

Because `r.URL.EscapedPath()` is not lowercased, case differences in the request path can cause the escaped-space match to fail even though `MatchPath` is meant to be case-insensitive. For example, with a pattern of `/admin%2Fpanel`:

- Requesting `/admin%2Fpanel` matches and can be denied as intended. - Requesting `/ADMIN%2Fpanel` does not match and falls thro…

UBUNTU-CVE-2026-27587

2026-10-03T10:52:41.259327+00:00

Affected: Ubuntu:Pro:24.04:LTS: caddy, Ubuntu:25.10: caddy, Ubuntu:Pro:26.04:LTS: caddy