CVE-2026-92284— Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS

Quick assessment

Copy summary Copy citation

Affected

caddyserver caddy

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply,

CVE-2026-92284 affects caddyserver caddy. No confirmed in-the-wild exploitation; assess based on exposure. Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete req CVE-2026-92284 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2026-92284

I. Basic Information for CVE-2026-92284

Affected Products

II. Public POCs for CVE-2026-92284

III. Intelligence Information for CVE-2026-92284

Vendor Advisories for CVE-2026-92284 (1)

• 🔗 Three vulnerabilities in Caddy v2.11.3: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass · Advisory · caddyserver/caddy · GitHub Read full article x_refsource_CONFIRM

• https://www.cve.org/CVERecord?id=CVE-2026-92284

IV. Related Vulnerabilities

V. Comments for CVE-2026-92284