SB20261109224 - Inconsistent interpretation of HTTP requests in Caddy

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109224

SB20261109224 - Inconsistent interpretation of HTTP requests in Caddy

Published: November 9, 2026

Security Bulletin ID SB20261109224
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-55458)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an attacker controlling an upstream server to inject hop-by-hop headers into responses forwarded to clients.

The vulnerability exists due to missing hop-by-hop header filtering in Caddy's reverse proxy when processing upstream WebSocket upgrade responses. An attacker controlling an upstream server can supply crafted headers in a 101 Switching Protocols response that reach a client initiating a proxied WebSocket connection.


Remediation

Install update from vendor's website.

References