CVE catalog

CVE-2026-92284

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an un

[CVE catalog]

Severity
Medium · CVSS 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.39% · Oct 25, 2026

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and process termination.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancaddysid2.11.4-1unknown
Debiancaddyforky2.11.4-1unknown
Debiancaddytrixie2.6.2-12+deb13u1unknown
Debiancaddytrixie-security2.6.2-12+deb13u1unknown
Debiancaddybookworm2.6.2-5unknown
Debiancaddybookworm-security2.6.2-5+deb12u1unknown

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancaddysourcesid(unfixed)not yet assignedNot reportedNot reported
Debiancaddysourceforky(unfixed)not yet assignedNot reportedNot reported
Debiancaddysourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiancaddysourcebookworm(unfixed)not yet assignedNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [caddy]Affected
    Details (2)

    • 2.6.2-5 · amd64 · bookworm

      Affected

      nvd · caddy · debian · bookworm; nvd · caddy · debian · 12

    • 2.6.2-5 · arm64 · bookworm

      Affected

      nvd · caddy · debian · bookworm; nvd · caddy · debian · 12

[Debian 13 (Trixie)]

  • [caddy]Affected
    Details (5)

    • 2.6.2-12+b3 · amd64 · trixie

      Affected

      nvd · caddy · debian · 13

    • 2.6.2-12+b3 · arm64 · trixie

      Affected

      nvd · caddy · debian · 13

    • 2.11.2-1~bpo13+1 · amd64 · trixie-backports

      Affected

      nvd · caddy · debian · 13

    • 2.6.2-12+deb13u1 · amd64 · trixie-security

      Affected

      nvd · caddy · debian · 13

    • 2.6.2-12+deb13u1 · arm64 · trixie-security

      Affected

      nvd · caddy · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]