{"id":"EUVD-2026-85514","enisaUuid":"4e8bffd9-f3dd-3434-88bd-a04a3d80a476","description":"Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and process termination.","datePublished":"Sep 23, 2026, 5:58:42 PM","dateUpdated":"Sep 23, 2026, 7:21:14 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9\n","aliases":"CVE-2026-92284\n","assigner":"GitHub_M","epss":0.39,"enisaIdProduct":[{"id":"0550825d-2fd3-3dbc-bff1-97912a488ced","product":{"name":"caddy","vendor":{"name":"caddyserver"}},"product_version":"≤ 2.11.3"}],"enisaIdVendor":[{"id":"d17776d0-aaf0-3d04-83b2-41732c732861","vendor":{"name":"caddyserver"}}],"enisaIdVulnerability":[{"id":"9a6864cf-8250-3713-bc0c-451921f79ef9","vulnerability":{"id":"CVE-2026-92284","description":"Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and process termination.","datePublished":"Sep 23, 2026, 5:58:42 PM","dateUpdated":"Sep 23, 2026, 7:21:14 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9\n","enisa_id":"EUVD-2026-85514\n","assigner":"GitHub_M","epss":0.39,"dataProcessed":"Nov 11, 2026, 7:22:32 AM","vulnerabilityProduct":[{"id":"dcc3c37a-44a9-336f-8beb-02b8fd494a5c","product":{"name":"caddy","vendor":{"name":"caddyserver"}},"product_version":"≤ 2.11.3"}],"vulnerabilityVendor":[{"id":"7cef7279-fe8a-3706-862b-bb83c7dfbcc9","vendor":{"name":"caddyserver"}}]}}],"enisaIdAdvisory":[]}