Header Injection Flaw in Caddy Server by Caddy Corp

CVE-2026-52845

What is CVE-2026-52845?

An issue in Caddy Server allows remote clients to manipulate identity and group headers due to mishandling of HTTP header normalization during the forward authentication process. When clients send headers using underscores, these headers persist through a deletion step and can result in unauthorized injection or overriding of trusted identity values. This situation poses significant security risks for PHP/FastCGI applications that depend on accurate identity validation. Updating to version 2.11.4 resolves this vulnerability.

References