CVE-2026-27588 is a critical flaw (CVSS 9.1) in Caddy. When a host matcher lists more than 100 entries, matching becomes case sensitive, so changing the casing of the Host header can bypass host based routing and its access controls. Upgrade to Caddy 2.11.1 or later.
What's affected
Caddy before 2.11.1. The documented behaviour is a case insensitive host match. The advisory says a large host list, meaning over 100 entries, switches to an optimised path that compares exactly.
GitHub advisories for these Caddy issues list v2.11.0 as the patched version, but the release notes say the first 2.11 release was published as v2.11.1, with no code changes from v2.11.0 other than a CI job. Plan on v2.11.1 or later.
The record lists KEV as false.
How to check if you're exposed
Check the version and count entries in each host matcher.
caddy version
caddy adapt --config /etc/caddy/Caddyfile --pretty > caddy.json
In the adapted JSON, look at every host matcher and count its entries. Any route with 101 or more exact host names is in scope. Large multi tenant setups with a long list of customer domains are the typical case.
What to do now
- Upgrade to Caddy 2.11.1 or later.
- Find routes with long host lists, and note which ones attach access controls to the match.
- Where possible, split very long host lists into smaller route groups until you have patched.
- Do not let host header matching be your only authorization step for sensitive routes.
- Review logs for Host headers in unusual casing.
Why it matters
This is another CWE-178 case, case handling mistakes in matching. The advisory describes a fast path using binary search with a plain string comparison, and a fallback loop that stops early for large lists, so the case insensitive comparison never runs.
The lesson is that an optimisation changed behaviour past a size threshold. Nothing looks wrong when you test with ten hosts. At 101 hosts the semantics change, and routing and any rules tied to it follow.
Quick check
Why does the number 100 matter?
The advisory says the optimised matching path is used when the host list has more than 100 entries, and that path compares case sensitively.
Sources
Last reviewed: 19 October 2026.
