CVE-2026-92284

Executive Summary

CVE-2026-92284 is an uncontrolled resource consumption (memory exhaustion) vulnerability in the Caddy web server up to and including version 2.11.3. A remote, unauthenticated attacker can trigger the flaw by causing the Caddy HTTP request-body placeholder (http.request.body) to be resolved, which reads the entire request body into memory via an unbounded io.Copy in modules/caddyhttp/replacer.go, before any request-body limiting middleware is applied. Successful exploitation results in process-wide memory exhaustion and termination of the Caddy process, causing a denial-of-service condition for all hosted sites and reverse-proxied services. No public PoC, exploit code, or Nuclei template is currently available, and no vendor patch has been released as of this report.

Technical Analysis

Caddy is an extensible, TLS-by-default server platform written in Go, widely used as a reverse proxy, load balancer, and file server. The vulnerability resides in the HTTP replacer module at modules/caddyhttp/replacer.go, which is responsible for resolving placeholder tokens (such as {http.request.body}) that can appear in configuration directives, logs, headers, or response templates.

The core defect is a violation of the CWE-770 (Allocation of Resources Without Limits or Throttling) class. When the http.request.body placeholder is resolved, the code executes an unbounded io.Copy that reads the complete request body into memory. Critically, this read occurs before any request-body limiting middleware is able to apply its constraints. The ordering of operations is the crux of the flaw: middleware designed to cap body size (a standard defense against memory-exhaustion attacks) is bypassed because the replacement/resolution logic runs earlier in the request handling pipeline than the limiting logic.

Because there is no size cap on the copy operation, an attacker who can cause the placeholder to be evaluated and who can submit an arbitrarily large (or slow, unbounded) request body can force the server to allocate memory equal to the body size. A single connection with a multi-gigabyte body, or many concurrent connections with moderately sized bodies, can exhaust available memory. Once the Go runtime cannot satisfy allocations, the Caddy process terminates (or is OOM-killed by the operating system), taking down every virtual host and proxied backend it serves.

Attack surface considerations:

• The flaw is reachable only where a configuration causes http.request.body (or an equivalent body-reading placeholder) to be resolved for incoming requests. Caddy configurations that never reference the request-body placeholder in the relevant request path are not exposed.
• Exploitation is network-reachable and requires no authentication or user interaction, consistent with an AV:N/PR:N/UI:N profile.
• The impact is availability-only (C:N/I:N/A:H): confidentiality and integrity are not directly affected by this mechanism; the harm is resource exhaustion and process termination.

The io.Copy behavior is inherent to Go's standard library — it reads from a source until EOF without an upper byte bound unless the caller supplies one (e.g., via io.LimitReader or an explicit size check). The absence of such a bound, combined with the pre-middleware execution ordering, constitutes the vulnerability. No CVE-assigned CVSS score was published in the source data; the vector provided here reflects the described network-reachable, availability-impacting characteristics and should be treated as analyst assessment rather than a vendor- or NVD-published score.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-92284; the attack chain below is inferred strictly from the vulnerability class (CWE-770) and the behavior described in the NVD entry. No specific function names, endpoints, or parameters beyond those in the description are asserted.

1. Reconnaissance / target identification. An attacker identifies internet-facing Caddy servers (version 2.11.3 or earlier). Fingerprinting can leverage the Server: Caddy response header, default TLS certificate characteristics, and Shodan/scanning queries such as product:"Caddy". The attacker then determines whether any request path evaluates a body-reading placeholder — for example, by probing endpoints that reflect request data (logging-driven reflections, templated responses, or debug/echo-style routes) and observing whether submitting a body causes the server to acknowledge or echo body content. This step is reconnaissance only; success indicates the placeholder is being resolved for that route.

2. Triggering the flaw class. The attacker sends an HTTP request to an affected path, including a request body, in a manner that causes the http.request.body placeholder to be resolved during request handling. Because resolution performs an unbounded io.Copy ahead of the body-size-limiting middleware, the attacker's body is read in full regardless of any configured limit. The essential trigger is the interplay of (a) a configuration that resolves the body placeholder and (b) a body of arbitrary size; no authentication is required.

3. Payload / execution method (vulnerability-class level). This is not a code-execution vulnerability. The "payload" is simply a large request body delivered over HTTP. The attacker can send a single large body (declared and delivered via a large Content-Length, or streamed in chunks) or open many concurrent connections each supplying sizable bodies. Memory consumption scales with the total body bytes accepted, and the unbounded copy ensures no configured ceiling is honored. Note: the exact directive or placeholder-triggering configuration is configuration-dependent; the CVE does not enumerate specific routes.

4. Post-exploitation impact. As memory is consumed, the Caddy process's footprint grows until allocation fails or the OS out-of-memory killer intervenes, terminating the process. The result is a denial of service affecting all sites and proxied upstreams handled by that Caddy instance. An attacker may repeat the request to maintain the outage (availability persistence). No data exfiltration or code execution is implied by this vulnerability class.

Confidence note: Because no public exploit exists, reliability of the above chain depends on a deployment actually resolving the body placeholder. Environments that never reference http.request.body in the request path are not exploitable via this mechanism.

Impact Assessment

The primary impact is availability loss. On successful exploitation, the Caddy process terminates, causing an outage for every virtual host, reverse proxy route, and upstream service fronted by that instance. In shared-hosting or gateway deployments, the blast radius can span many downstream applications from a single Caddy node. Recovery typically requires process restart and may involve OS-level intervention (OOM-killer recovery, container restart).

Reference to CVSS subscores (analyst-assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H):

• AV:N (Network): exploitable over the network.
• AC:L (Low): no special conditions beyond a config that resolves the body placeholder.
• PR:N / UI:N: no privileges or user interaction required.
• S:U (Unchanged): impact confined to the vulnerable component.
• C:N / I:N: no confidentiality or integrity impact attributed.
• A:H (High): full loss of availability of the Caddy process and its hosted services.

Business impact includes service downtime, SLA breaches, potential cascading failures for dependent systems, and operational cost of incident response and restarts. Because the flaw is trivially network-reachable and requires no credentials, it is well-suited to opportunistic volumetric/DoS abuse.

Detection Guidance

Detection strategy focuses on identifying unusually large or abnormally slow request bodies, repeated body-bearing requests to routes that resolve body placeholders, and memory/process-termination events on Caddy hosts.

Sigma Rule

title: Caddy Request Body Memory Exhaustion Attempt (CVE-2026-92284)
id: 3f8b2c1a-9d47-4e21-b6a5-caddy92284
status: experimental
description: Detects large or repeated HTTP request bodies to Caddy that may trigger unbounded io.Copy on http.request.body placeholder resolution, consistent with CVE-2026-92284.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92284
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: caddy
detection:
  selection_large_body:
    cs-bytes|gte: 50000000
  selection_status:
    sc-status:
      - 0
      - 413
      - 500
      - 502
  selection_uri:
    cs-uri-stem|contains: '/'
  condition: selection_large_body or (selection_status and selection_large_body)
  timeframe: 5m
fields:
  - c-ip
  - cs-uri-stem
  - cs-bytes
  - sc-status
falsepositives:
  - Legitimate large file uploads to endpoints that do accept large bodies
level: medium
tags:
  - attack.t1190
  - cve.2026.92284
  - cwe.770

YARA Rule

rule CVE_2026_92284_Caddy_Body_Exhaustion
{
    meta:
        description = "Detects Caddy configurations resolving the http.request.body placeholder that may be exposed to CVE-2026-92284"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92284"
        date = "2026-01-01"
        cve = "CVE-2026-92284"
    strings:
        $placeholder = "http.request.body"
        $module_path = "modules/caddyhttp/replacer.go"
        $caddy_id = "Caddy" ascii wide nocase
    condition:
        uint16(0) == 0x7B0A or // JSON/Caddyfile-like start
        ( $placeholder and $caddy_id ) or
        $module_path
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92284 Caddy Request Body Memory Exhaustion Attempt"; flow:established,to_server; http.request_body; content:"|"; byte_test:1,>,0,0,relative,dce; threshold:type both, track by_src, count 1, seconds 60; dsize:>5000000; classtype:attempted-dos; sid:9228401; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and http.request.body.bytes > 5000000 ]
  [ process where event.type in ("end", "process_stopped") and process.name == "caddy" ]

Splunk SPL Query

index=web sourcetype=caddy OR sourcetype=access_combined
| where bytes > 5000000 OR resp_bytes > 5000000
| stats count AS requests, sum(bytes) AS total_body_bytes, dc(uri_path) AS paths
        by src_ip, uri_path
| where requests > 3 OR total_body_bytes > 200000000
| sort - total_body_bytes
| table src_ip, uri_path, requests, total_body_bytes

Wazuh OSSEC Rule

<group name="web,caddy,attack,">
  <rule id="922840" level="10">
    <decoded_as>json</decoded_as>
    <field name="request.body_bytes">\d{8,}</field>
    <description>CVE-2026-92284: Abnormally large HTTP request body to Caddy, possible memory exhaustion attempt.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_92284,</group>
  </rule>
  <rule id="922841" level="12">
    <if_sid>922840</if_sid>
    <same_source_ip />
    <description>CVE-2026-92284: Repeated large-body requests from same source, likely Caddy DoS exploitation activity.</description>
    <group>cve_2026_92284,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Audit Caddy configurations for any use of the http.request.body placeholder (or equivalent body-reading placeholders) in request-handling paths. Where the placeholder is not operationally required, remove or avoid it. Note: this is the single most direct mitigation, since the flaw is only reachable where the placeholder is resolved.
• Place an external request-body size limit in front of Caddy (e.g., a reverse proxy, WAF, or network device configured to cap Content-Length and enforce maximum body size on streaming/chunked requests) so the pre-middleware unbounded read is constrained before it reaches Caddy.
• Rate-limit or throttle connections per client IP and monitor for large-body floods to reduce the ability to exhaust memory via concurrency.
• Configure process supervisors (systemd, container orchestrators) to restart Caddy automatically on termination, reducing outage duration, and apply memory cgroup limits so exhaustion is contained to the Caddy process rather than the host.

2. Patch/upgrade steps

• No vendor patch is available as of this report. Monitor the Caddy project's release channels for a fixed version above 2.11.3.
• When a fixed version is released, upgrade promptly and re-verify that request-body limiting middleware now applies before placeholder resolution.
• Because there is no patch evidence from any tracked source, confirm any claimed fix against the official vendor advisory before deploying.

3. Long-term hardening

• Treat request-body-consuming logic as untrusted-input handling: always enforce explicit size bounds (e.g., io.LimitReader-style caps) on body reads and ensure such limits execute before any body-consuming placeholder resolution.
• Adopt defense-in-depth: front Caddy with an edge proxy/WAF that enforces global body-size and connection-rate limits independent of application configuration.
• Include resource-exhaustion test cases (oversized and slow bodies) in configuration review and CI for any deployment that resolves request-body placeholders.
• Maintain centralized logging/monitoring of request body sizes and Caddy process lifecycle to detect and alert on exhaustion patterns early.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-92284
• CWE-770 — Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Caddy project repository (monitor for fixes to modules/caddyhttp/replacer.go): https://github.com/caddyserver/caddy
• FIRST.org EPSS: not yet scored for CVE-2026-92284 at time of writing; CISA KEV: not listed.

No known threat actor campaigns or in-the-wild exploitation evidence were identified in the source data at the time of this report. No public PoC, exploit code, or Nuclei template is available; exploitation status remains theoretical based on the vulnerability class.