Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55458— Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through

Quick assessment

Affected
caddyserver caddy
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Caddy 是一个默认启用 TLS 的可扩展服务器平台。在 2.11.5 版本之前，其反向代理模块 中的 方法会在执行用于普通响应的 及 删除循环之前，先处理上游返回的"101 Switching Protocols"（协议切换）响应。该过早返回会调用 ，该方法将上游响应头原样复制给客户端，并仅对 WebSocket 特定的头部名称进行规范化。因此，任何能够控制或攻破被代理 WebSocket 上游的 attacker，均可促使如 、 、 等逐跳（hop-by-hop）头部，以及由 头部所命名的其他头部，穿越代理边

CVSS 2.9 · Low
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55458

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
Source: CVE Program / CVE List V5
Vulnerability Description
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.5, the reverse proxy's finalizeResponse method in modules/caddyhttp/reverseproxy/reverseproxy.go handles an upstream 101 Switching Protocols response before running removeConnectionHeaders and the hopHeaders deletion loop used for ordinary responses. The early return invokes handleUpgradeResponse, which copies the upstream headers to the client and normalizes only WebSocket-specific header names. An attacker who controls or compromises a proxied WebSocket upstream can therefore cause hop-by-hop headers such as Alt-Svc, Keep-Alive, and Proxy-Authenticate, as well as headers named by Connection, to cross the proxy boundary. For HTTP/2 or HTTP/3 extended CONNECT, the upstream 101 response may be represented to the client as an ordinary successful response, increasing the chance that leaked headers are processed. This issue is fixed in version 2.11.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Source: CVE Program / CVE List V5
Vulnerability Type
HTTP请求的解释不一致性(HTTP请求私运)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
caddyserver caddy < 2.11.5 -

II. Public POCs for CVE-2026-55458

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55458

请登录查看更多情报信息。

Other References for CVE-2026-55458 (3)

IV. Related Vulnerabilities

Same product: caddy
Same vendor: caddyserver
Same weakness: CWE-444