Multiple vulnerabilities have been identified in the handler and placeholder resolution layer of the Caddy web server, permitting information disclosure, denial of service, and access control bypass. These flaws stem from incomplete input sanitization, unbounded memory buffering, and case-sensitive path matching during request processing. An unauthenticated remote attacker can exploit these weaknesses to exfiltrate sensitive environment variables, crash instances via memory exhaustion, or read restricted files. The overall security posture of impacted deployments is severely degraded, particularly where custom rewrite rules, body placeholders, or file-hiding directives are heavily utilized. To address these exposure risks, administrators must evaluate their configurations and apply vendor-provided software updates immediately.
CVE-2026-77281: A double-expansion flaw in the rewrite handler allows remote attackers to inject syntax via HTTP request headers that triggers secondary placeholder evaluation, leading to the exfiltration of internal environment variables, internal request variables, or system files. Another vector within the request body placeholder fails to enforce size limits during buffer allocation, enabling an unauthenticated remote attacker to submit oversized HTTP payloads that trigger out-of-memory crashes and severe denial of service. Additionally, the static file server utilizes case-sensitive glob matching for the file-hiding functionality, enabling remote attackers to bypass path access controls and access hidden files by submitting uppercase character variants on case-insensitive filesystems.[/subscribe_to_unlock_form]
Multiple vulnerabilities have been identified in the handler and placeholder resolution layer of the Caddy web server, permitting information disclosure, denial of service, and access control bypass. These flaws stem from incomplete input sanitization, unbounded memory buffering, and case-sensitive path matching during request processing. An unauthenticated remote attacker can exploit these weaknesses to exfiltrate sensitive environment variables, crash instances via memory exhaustion, or read restricted files. The overall security posture of impacted deployments is severely degraded, particularly where custom rewrite rules, body placeholders, or file-hiding directives are heavily utilized. To address these exposure risks, administrators must evaluate their configurations and apply vendor-provided software updates immediately.
CVE-2026-77281: A double-expansion flaw in the rewrite handler allows remote attackers to inject syntax via HTTP request headers that triggers secondary placeholder evaluation, leading to the exfiltration of internal environment variables, internal request variables, or system files. Another vector within the request body placeholder fails to enforce size limits during buffer allocation, enabling an unauthenticated remote attacker to submit oversized HTTP payloads that trigger out-of-memory crashes and severe denial of service. Additionally, the static file server utilizes case-sensitive glob matching for the file-hiding functionality, enabling remote attackers to bypass path access controls and access hidden files by submitting uppercase character variants on case-insensitive filesystems.[emaillocker id="1283"]
Organizations operating affected instances should immediately apply security patches and enforce baseline input validation across all routing directives. Monitoring request logs for abnormal character cases in hidden path requests and inspecting memory usage spikes can help detect exploitation attempts prior to remediation. Upgrading to the latest non-vulnerable software release ensures all placeholder expansion pathways are properly sanitized and bound by appropriate execution limits.
We recommend you to update Caddy to version 2.11.4.
The following reports contain further technical details:
[/emaillocker]