LOW GitHub
CVE-2026-55458
Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
### AI Disclosure
This vulnerability was discovered via deepseek-v4-pro[1m] for finding potential vulnerabilities / inconsistencies in the code base. I made the AI check if Caddy is compliant with various RFCs, incl. 7230. I also used it to help write the PoC, since it was honestly much faster than writing it by hand. I also let it write parts of this advisory text for brevity's sake, but had to rewrite half of it by hand.
### Summary
Caddy's reverse proxy fails to strip RFC 7230 hop-by-hop h
Affected Products
- go/github.com/caddyserver/caddy/v2 <= 2.11.4
References
- https://github.com/advisories/GHSA-8qx7-j2v2-x6q5
- https://github.com/caddyserver/caddy/security/advisories/GHSA-8qx7-j2v2-x6q5
- https://github.com/caddyserver/caddy/releases/tag/v2.11.5
- https://github.com/advisories/GHSA-8qx7-j2v2-x6q5
This low severity vulnerability was published on 2026-10-28 via GitHub. Affected: go/github.com/caddyserver/caddy/v2 <= 2.11.4.
vulnfeed aggregates 14990 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.