Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request matcher is documented as case-insensitive, but when configured with a large host list (>100 entries) it becomes case-sensitive due to an optimized matching path. An attacker can bypass host-based routing and any access controls attached to that route by changing the casing of the `Host` header. Version 2.11.1 contains a fix for the issue.
Published: 2026-02-24
CVSS: 9.1
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Download Exploit for CVE-2026-27588 here:
Use Tor Browser to access .onion site.
https://sonitex.com/exploit-240-cve-2026-3167/
https://sonitex.com/exploit-560-cve-2026-29188/
https://sonitex.com/exploit-377-cve-2025-12462/