UpHeron
All vulnerabilities

Go

CVE-2026-27587

Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass

Severity
High
Published
24 Feb 2026
Last changed
27 Feb 2026
Added to UpHeron
22 Oct 2026
Fixed in
2.11.1
Also known as
GHSA-g7pc-pc7g-h8jh, GO-2026-4538
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
CaddyGo · osv:Go:github.com/caddyserver/caddy/v2
  • Every version before 2.11.1

References