{"id":"CVE-2026-92284","title":"Caddy is an extensible server platform that uses TLS by default","summary":"Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body m…","severity":"medium","cvss":6.9,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","cwe":["CWE-770"],"vendor":"caddyserver","product":"caddy","affected":["caddy <= 2.11.3"],"published":"2026-09-23","updated":"2026-09-23","sourceUpdated":"2026-09-23T20:17:21.903","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92284","references":[{"url":"https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9","label":"security-advisories@github.com"},{"url":"https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-23T19:18:11.334797Z"},"cvssSource":"cna","ingestedAt":"2026-09-23T18:29:33.264Z","slug":"CVE-2026-92284","body":"## Overview\n\nCaddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and process termination.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":50,"depthScoreParts":{"impact":38,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":209845,"id":"CVE-2026-92284","ts":1790191914097,"field":"exploit_available","old":"false","new":"true"}]}