CVE-2026-92284: Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and process termination.
Affected Software
Event History
Frequently Asked Questions
What configuration condition makes a Caddy deployment exposed?
Exposure requires configuration that resolves the http.request.body placeholder. The issue occurs when that placeholder causes Caddy to read the complete request body before request-body middleware limits are applied.
What does an attacker need to do to trigger the denial of service?
An attacker needs to send a request with a sufficiently large body to a configuration that resolves http.request.body. The unbounded body copy can exhaust memory and terminate the Caddy process.
Do request-body middleware limits mitigate this issue?
No. The vulnerable placeholder resolution occurs before request-body middleware limits apply, so those limits do not constrain the body read involved in this issue.
Which versions are affected?
Caddy version 2.11.3 and earlier are affected.