CVE-2026-92284 Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS
Attackers can cause memory exhaustion and process termination in Caddy by sending large request bodies, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92284?
CVE-2026-92284 is a medium-severity denial of service vulnerability in caddyserver caddy, published on 23 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and process termination.
Weakness: CWE-770
Which versions are affected by CVE-2026-92284?
How do I fix CVE-2026-92284?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-92284 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92284 exists.
Sources
Also known as DEBIAN-CVE-2026-92284, UBUNTU-CVE-2026-92284.