UpHeron
All vulnerabilities

Servers and applications

CVE-2018-19148

Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames. Specifically, when unable to match a Host header with a vhost in its configuration, it serves the X.509 certificate for a randomly selected vhost in its configuration. Repeated requests (with a nonexistent hostname in the Host header) permit full enumeration of…

Severity
Low 3.7
Published
10 Nov 2018
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
0.9% in the next 30 daysHigher than 58% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
CaddyServers and applications · cpe:a:caddyserver:caddy
  • Every version up to 0.11.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-19148
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-19148