data/osv/GO-2026-4541.json

{
  "schema_version": "1.3.1",
  "id": "GO-2026-4541",
  "modified": "0001-01-01T00:00:00Z",
  "published": "0001-01-01T00:00:00Z",
  "aliases": [
    "CVE-2026-27588",
    "GHSA-x76f-jf84-rqj8"
  ],
  "summary": "Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2",
  "details": "Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2",
  "affected": [
    {
      "package": {
        "name": "github.com/caddyserver/caddy/v2",
        "ecosystem": "Go"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.1"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "imports": [
          {
            "path": "github.com/caddyserver/caddy/v2/modules/caddyhttp",
            "symbols": [
              "App.Cleanup",
              "App.Provision",
              "App.Start",
              "App.Stop",
              "App.Validate",
              "CELMatcherImpl",
              "CELValueToMapStrList",
              "CIDRExpressionToPrefix",
              "Error",
              "HandlerError.Error",
              "HandlerFunc.ServeHTTP",
              "Invoke.ServeHTTP",
              "LoggableHTTPHeader.MarshalLogObject",
              "LoggableHTTPRequest.MarshalLogObject",
              "LoggableTLSConnState.MarshalLogObject",
              "MatchClientIP.CELLibrary",
              "MatchClientIP.Match",
              "MatchClientIP.MatchWithError",
              "MatchClientIP.Provision",
              "MatchClientIP.UnmarshalCaddyfile",
              "MatchExpression.MarshalJSON",
              "MatchExpression.Match",
              "MatchExpression.MatchWithError",
              "MatchExpression.Provision",
              "MatchExpression.UnmarshalCaddyfile",
              "MatchExpression.UnmarshalJSON",
              "MatchHeader.CELLibrary",
              "MatchHeader.Match",
              "MatchHeader.MatchWithError",
              "MatchHeader.UnmarshalCaddyfile",
              "MatchHeaderRE.CELLibrary",
              "MatchHeaderRE.Match",
              "MatchHeaderRE.MatchWithError",
              "MatchHeaderRE.Provision",
              "MatchHeaderRE.UnmarshalCaddyfile",
              "MatchHeaderRE.Validate",
              "MatchHost.CELLibrary",
              "MatchHost.Match",
              "MatchHost.MatchWithError",
              "MatchHost.Provision",
              "MatchHost.UnmarshalCaddyfile",
              "MatchMethod.CELLibrary",
              "MatchMethod.UnmarshalCaddyfile",
              "MatchNot.MarshalJSON",
              "MatchNot.Match",
              "MatchNot.MatchWithError",
              "MatchNot.Provision",
              "MatchNot.UnmarshalCaddyfile",
              "MatchNot.UnmarshalJSON",
              "MatchPath.CELLibrary",
              "MatchPath.Match",
              "MatchPath.MatchWithError",
              "MatchPath.UnmarshalCaddyfile",
              "MatchPathRE.CELLibrary",
              "MatchPathRE.Match",
              "MatchPathRE.MatchWithError",
              "MatchProtocol.CELLibrary",
              "MatchProtocol.Match",
              "MatchProtocol.MatchWithError",
              "MatchProtocol.UnmarshalCaddyfile",
              "MatchQuery.CELLibrary",
              "MatchQuery.Match",
              "MatchQuery.MatchWithError",
              "MatchQuery.UnmarshalCaddyfile",
              "MatchRegexp.Match",
              "MatchRegexp.Provision",
              "MatchRegexp.UnmarshalCaddyfile",
              "MatchRegexp.Validate",
              "MatchRemoteIP.CELLibrary",
              "MatchRemoteIP.Match",
              "MatchRemoteIP.MatchWithError",
              "MatchRemoteIP.Provision",
              "MatchRemoteIP.UnmarshalCaddyfile",
              "MatchTLS.UnmarshalCaddyfile",
              "MatchVarsRE.CELLibrary",
              "MatchVarsRE.Match",
              "MatchVarsRE.MatchWithError",
              "MatchVarsRE.Provision",
              "MatchVarsRE.UnmarshalCaddyfile",
              "MatchVarsRE.Validate",
              "MatcherSet.Match",
              "MatcherSet.MatchWithError",
              "MatcherSets.AnyMatch",
              "MatcherSets.AnyMatchWithError",
              "MatcherSets.FromInterface",
              "MatcherSets.String",
              "ParseCaddyfileNestedMatcherSet",
              "ParseNamedResponseMatcher",
              "PrepareRequest",
              "ResponseHandler.Provision",
              "ResponseMatcher.Match",
              "ResponseWriterWrapper.Push",
              "ResponseWriterWrapper.ReadFrom",
              "Route.Provision",
              "Route.ProvisionHandlers",
              "Route.ProvisionMatchers",
              "Route.String",
              "RouteList.Provision",
              "RouteList.ProvisionHandlers",
              "RouteList.ProvisionMatchers",
              "Server.ServeHTTP",
              "StaticError.ServeHTTP",
              "StaticError.UnmarshalCaddyfile",
              "StaticIPRange.Provision",
              "StaticResponse.ServeHTTP",
              "StaticResponse.UnmarshalCaddyfile",
              "StringArray.UnmarshalJSON",
              "Subroute.Provision",
              "Subroute.ServeHTTP",
              "VarsMatcher.CELLibrary",
              "VarsMatcher.Match",
              "VarsMatcher.MatchWithError",
              "VarsMatcher.UnmarshalCaddyfile",
              "VarsMiddleware.ServeHTTP",
              "VarsMiddleware.UnmarshalCaddyfile",
              "WeakString.MarshalJSON",
              "WeakString.UnmarshalJSON"
            ]
          }
        ]
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-x76f-jf84-rqj8"
    },
    {
      "type": "FIX",
      "url": "https://github.com/caddyserver/caddy/commit/eec32a0bb5a11651c6a7b04ce82dc50610f2b27e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/caddyserver/caddy/releases/tag/v2.11.1"
    }
  ],
  "database_specific": {
    "url": "https://pkg.go.dev/vuln/GO-2026-4541",
    "review_status": "REVIEWED"
  }
}