CVE-2026-92284

EUVD-2026-85514
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and process termination.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GitHub_MCNA
6.9 MEDIUM
NETWORK
LOW
NONE
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Base Score
CVSS 3.x
EPSS Score
Percentile: 33.12%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
caddyservercaddy
𝑥
≤ 2.11.3
CNA
Debian logo
Debian Releases
Debian Product
Codename
caddy
bookworm
undetermined
bookworm (security)
undetermined
forky
undetermined
sid
undetermined
trixie
undetermined
trixie (security)
undetermined
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
caddy
jammy
dne
noble
needs-triage
resolute
needs-triage
stonking
needs-triage
Common Weakness Enumeration
References
https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9
https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9