THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-j8px-rmrx-76h9 (medium) — Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass

[GHSA] GHSA-j8px-rmrx-76h9 (medium) — Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass

medgithub_advisoriesPublished 2026-09-18

GHSA-j8px-rmrx-76h9 Severity: medium CVE: CVE-2026-77281

Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass

# Caddy v2.11.3 — Three vulnerabilities in handler/placeholder layer

**Tested against:** `caddy:2.11.3` (official Docker image, SHA verified at runtime) **Reproduction environment:** Docker Desktop 4.73.1 / Engine 29.4.3 on Windows 1

MITRE ATT&CK techniques

VulnerabilitiesT1588.006
PowerShellT1059.001
CredentialsT1589.001

Indicators of compromise

CVE-2026-77281cve
CVE-2026-30852cve

Original source: https://github.com/advisories/GHSA-j8px-rmrx-76h9