CVE-2018-19148 Caddy allows enumeration of Certificates and Hostnames
Caddy web server leaks internal hostnames by serving random certificates for invalid requests, allowing attackers to enumerate private domains.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-19148?
CVE-2018-19148 is a low-severity vulnerability in n/a, published on 10 Nov 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames. Specifically, when unable to match a Host header with a vhost in its configuration, it serves the X.509 certificate for a randomly selected vhost in its configuration. Repeated requests (with a nonexistent hostname in the Host header) permit full enumeration of all certificates on the server. This generally permits an attacker to easily and accurately discover the existence of and relationships among hostnames that weren't meant to be public, though this information could likely have been discovered via other methods with additional effort.
Weakness: CWE-200
Which versions are affected by CVE-2018-19148?
2 open source packages ship an affected version, including github.com/caddyserver/caddy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/caddyserver/caddy Go | All versions | 0.11.1 |
github.com/caddyserver/caddy Go | All versions | 0.11.1 |
Products include Caddyserver Caddy.
How do I fix CVE-2018-19148?
Upgrade github.com/caddyserver/caddy to 0.11.1 or later.
Is CVE-2018-19148 being exploited?
There is no known exploitation of CVE-2018-19148 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2018-21246 Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication
- CVE-2026-27590 Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport
- CVE-2026-27586 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed
- CVE-2026-45135 Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
- CVE-2026-52845 Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
Sources
Also known as GHSA-jf2w-mq6r-56v8.