What’s Vulnerable › Vulnerabilities

CVE-2026-92284: Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-23 · updated 2026-09-30
• Weakness: CWE-770

Description

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and process termination.

Affected products

• caddyserver caddy: through 2.11.3

References

• https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9
• https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9

Get alerted when CVE-2026-92284 or the next vulnerability affects your stack