Security incident · CVE-2026-55458
Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
Published Oct 13, 2026 · catalog updated Oct 28, 2026 · Caddy has an RFC
Last checked Nov 1, 2026. A connected source was read within the last 7 days.
Open the advisory
Exploitation likelihood is not on this record for CVE-2026-55458. A missing EPSS score is not a low risk. Compare Caddy has an RFC with the linked advisory before you change production.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Caddy has an RFC).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- EPSS is missing. A missing score is not a low risk.
- Severity
- Low—
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- Not in the current FIRST EPSS dataset
- Remediation
- Version ranges on file
- Affected products
- Go github.com/caddyserver/caddy/v2 · go github.com/caddyserver/caddy/v2 · golang github.com
### AI Disclosure This vulnerability was discovered via deepseek-v4-pro[1m] for finding potential vulnerabilities / inconsistencies in the code base. I made the AI check if Caddy is compliant with various RFCs, incl. 7230. I also used it to help write the PoC, since it was honestly much faster than writing it by hand. I also let it write parts of this advisory text for brevity's sake, but had to rewrite half of it by hand. ### Summary Caddy's reverse proxy fails to strip RFC 7230 hop-by-hop headers from upstream responses when handling WebSocket upgrades (HTTP 101 Switching Protocols). Headers including , , , , or , which Caddy actually correctly strips for normal HTTP responses, pass through unfiltered to the client during protocol upgrades. An upstream that sets these headers (intentionally or otherwise) can inject them into client responses, enabling connection hijacking via , cookie injection via , and proxy authentication phishing. The normal response path in correctly strips all hop-by-hop headers before forwarding, but the 101 code path returns early, skipping the stripping entirely. ### Details In , the method (line 1178) handles upstream responses. For all normal responses, it strips hop-by-hop headers before copying to the client: However, the 101 Switching Protocols check at line 1187 returns before this stripping code: Inside ( ), all upstream response headers are copied to the client without any hop-by-hop filtering: The function (line 714) only handles WebSocket-specific header key mapping ( to ). It does not strip hop-by-hop headers. #### Hop-by-Hop Headers That Leak Through Defined at : All 10 are stripped from normal responses. **None** are stripped from WebSocket upgrade responses. For HTTP/2 and HTTP/3 WebSocket connections (extended CONNECT with ), Caddy converts the upstream's 101 into a for the client ( ). The leaked headers arrive in a standard HTTP 200 response that browsers fully process, making hijacking and injection practically exploitabl
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- Go github.com/caddyserver/caddy/v20 → 2.11.5
- go github.com/caddyserver/caddy/v2<=v2.11.4
- golang github.comversion unspecified
How to fix CVE-2026-55458
Upgrade
CVE-2026-55458 lists a fix boundary at 2.11.5. Compare the installed build with that boundary before you change production.
Version check
Fixed in 2.11.5 · 1 other ranges on the advisory
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
Exploitation likelihood is not on this record for CVE-2026-55458. A missing EPSS score is not a low risk. Compare Caddy has an RFC with the linked advisory before you change production.
Which versions are affected?
Compare what you have installed with 0 → 2.11.5, <=v2.11.4. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-444: HTTP Request Smuggling. EPSS is absent from the current FIRST dataset. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Technology hubs
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 28, 2026 · GitLab Advisory Database
Detected
Caddy's reverse proxy fails to strip RFC 7230 hop-by-hop headers from upstream responses when handling WebSocket upgrades (HTTP 101 Switching Protocols). Headers including Alt-Svc, Keep-Alive, Proxy-Authenticate, Transfer-Encoding, or Trailer, which Caddy actually correctly strips for normal HTTP responses, pass through unfiltered to the client during protocol upgrades. An upstream that sets these
Oct 28, 2026 · Go Vulnerability Database
Fix available
github.com/caddyserver/caddy/v2 fixed in 2.11.5
Oct 28, 2026 · Go Vulnerability Database
Fix available
github.com/caddyserver/caddy/v2 fixed in 2.11.5
Oct 28, 2026 · Go Vulnerability Database
Updated
### AI Disclosure This vulnerability was discovered via deepseek-v4-pro[1m] for finding potential vulnerabilities / inconsistencies in the code base. I made the AI check if Caddy is compliant with various RFCs, incl. 7230. I also used it to help write the PoC, since it was honestly much faster than writing it by hand. I also let it write parts of this advisory text for brevity's sake, but had to r
Sources
- CVE.orgVulnerability recordCVE-2026-55458
Official CVE identifier
cve.org - GitLab Advisory DatabasePackage advisoryCVE-2026-55458
Caddy's reverse proxy fails to strip RFC 7230 hop-by-hop headers from upstream responses when handling WebSocket upgrades (HTTP 101 Switching Protocols). Headers including Alt-Svc, Keep-Alive, Proxy-Authenticate, Transfer-Encoding, or Trailer, which Caddy actually correctly strips for normal HTTP responses, pass through unfiltered to the client during protocol upgrades. An upstream that sets these
advisories.gitlab.com - Go Vulnerability DatabasePackage advisoryGHSA-8qx7-j2v2-x6q5
Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
osv.dev - Maintainer security tabsVendor advisoryGHSA-8qx7-j2v2-x6q5
### Important up-front notice This is my first security report ever, I honestly apologize for any mistakes. ### AI Disclosure This vulnerability was discovered via deepseek-v4-pro[1m] for finding potential vulnerabilities / inconsistencies in the code base. I made the AI check if Caddy is compliant with various RFCs, incl. 7230. I also used it to help write the PoC, since it was honestly much fast
github.com
References
Freshness
Last verified in this catalog Nov 1, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- Maintainer security tabsNov 1, 2026
- Go Vulnerability DatabaseOct 30, 2026
- GitLab Advisory DatabaseOct 30, 2026
- CVE.orgOct 29, 2026