Memory Exhaustion Vulnerability in Caddy Server Versions

CVE-2026-92284

What is CVE-2026-92284?

In Caddy Server versions up to 2.11.3, a vulnerability exists in how the server processes HTTP request bodies. Specifically, the handling of request body reads can result in unbounded memory consumption due to the io.Copy method operating without limit. This can lead to significant memory exhaustion, potentially causing the server process to terminate. The issue arises before request-body middleware limitations can be applied, making it a critical concern for environments relying on Caddy for web services. Mitigation strategies are necessary to prevent service disruption.

References