High severityNVD Advisory· Published Feb 24, 2026· Updated Feb 27, 2026
Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass
CVE-2026-27587
Description
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP path request matcher is intended to be case-insensitive, but when the match pattern contains percent-escape sequences (%xx) it compares against the request's escaped path without lowercasing. An attacker can bypass path-based routing and any access controls attached to that route by changing the casing of the request path. Version 2.11.1 contains a fix for the issue.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/caddyserver/caddy/v2Go | < 2.11.1 | 2.11.1 |
Affected products
1Patches
12 files changed · +6 −0
modules/caddyhttp/matchers.go+1 −0 modified@@ -538,6 +538,7 @@ func (m MatchPath) MatchWithError(r *http.Request) (bool, error) { } func (MatchPath) matchPatternWithEscapeSequence(escapedPath, matchPath string) bool { + escapedPath = strings.ToLower(escapedPath) // We would just compare the pattern against r.URL.Path, // but the pattern contains %, indicating that we should // compare at least some part of the path in raw/escaped
modules/caddyhttp/matchers_test.go+5 −0 modified@@ -417,6 +417,11 @@ func TestPathMatcher(t *testing.T) { input: "/ADMIN%2fpanel", expect: true, }, + { + match: MatchPath{"/admin%2fpa*el"}, + input: "/ADMIN%2fPaAzZLm123NEL", + expect: true, + }, } { err := tc.match.Provision(caddy.Context{}) if err == nil && tc.provisionErr {
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
6- github.com/advisories/GHSA-g7pc-pc7g-h8jhghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-27587ghsaADVISORY
- github.com/caddyserver/caddy/commit/a1081194bfae4e0d8c227ec44aecb95eded55d1eghsaWEB
- github.com/caddyserver/caddy/releases/tag/v2.11.1ghsax_refsource_MISCWEB
- github.com/caddyserver/caddy/security/advisories/GHSA-g7pc-pc7g-h8jhghsax_refsource_CONFIRMWEB
- pkg.go.dev/vuln/GO-2026-4538ghsaWEB
News mentions
0No linked articles in our index yet.