CVE-2026-92284: Caddy Server Memory Exhaustion DOS Vulnerability

CVE-2026-92284 Overview

CVE-2026-92284 is a resource exhaustion vulnerability in Caddy, an extensible open-source web server that uses TLS by default. The flaw affects Caddy version 2.11.3 and earlier. In modules/caddyhttp/replacer.go, resolving the http.request.body placeholder triggers an unbounded io.Copy that reads the entire HTTP request body into memory before request-body middleware size limits are applied. A remote, unauthenticated attacker can send large request bodies to trigger memory exhaustion and terminate the Caddy process. The issue is tracked under CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
Remote, unauthenticated attackers can exhaust server memory and crash the Caddy process by sending oversized HTTP request bodies to endpoints that reference http.request.body.

Affected Products

Caddy web server, version 2.11.3
Caddy web server, all earlier 2.x releases
Deployments referencing the http.request.body placeholder in Caddyfile or JSON configuration

Discovery Timeline

2026-09-23 - CVE-2026-92284 published to NVD
2026-09-23 - Last updated in NVD database
Reference - Details published in the Caddy GitHub Security Advisory GHSA-j8px-rmrx-76h9

Technical Details for CVE-2026-92284

Vulnerability Analysis

Caddy's replacer subsystem exposes runtime values through placeholders that can be referenced anywhere in a Caddyfile or JSON configuration. When an operator references the http.request.body placeholder, the replacer must materialize the entire request body as a string value. The implementation in modules/caddyhttp/replacer.go performs this materialization with an io.Copy call that has no upper bound on the number of bytes read.

Critically, this read occurs before the request-body limiting middleware evaluates configured maximums. Any size ceiling defined through request_body max_size or equivalent JSON configuration is bypassed for placeholder resolution. An attacker sending a multi-gigabyte request body forces Caddy to allocate memory proportional to the request size until the operating system terminates the process.

Root Cause

The root cause is missing input validation on the size of data consumed during placeholder expansion. The replacer treats the request body as an unbounded stream and buffers it in full before any middleware in the request chain can enforce size limits. This ordering defect makes the request-body limiter ineffective when the body is referenced via placeholder.

Attack Vector

Exploitation requires network access to a Caddy instance whose configuration references http.request.body. Common examples include reverse-proxy rules that log request bodies, template directives that echo bodies into responses, or handlers that pass bodies to downstream systems through header rewrites. The attacker sends a single HTTP request with a large body, either using Content-Length or Transfer-Encoding: chunked. Caddy attempts to buffer the full payload, exhausts available memory, and terminates. Repeated requests produce a sustained denial-of-service condition against the affected endpoint.

No authentication is required, and the attack complexity is low. The affected code path is triggered per request, so a single attacker without concurrency can disrupt service.

Detection Methods for CVE-2026-92284

Indicators of Compromise

Caddy process termination events accompanied by out-of-memory (OOM) killer entries in dmesg or journalctl -k.
Sudden spikes in resident set size (RSS) for the Caddy process correlated with inbound requests carrying large Content-Length headers.
HTTP 5xx responses or connection resets from Caddy following requests to endpoints that reference http.request.body.

Detection Strategies

Audit Caddyfile and JSON configurations for any use of the {http.request.body} placeholder and inventory the exposed routes.
Enable Caddy access logging with request size fields and alert on requests exceeding expected body thresholds for those routes.
Correlate host-level OOM events with Caddy access logs to identify likely exploitation attempts.

Monitoring Recommendations

Monitor Caddy process memory usage with node-level metrics and trigger alerts when RSS crosses a baseline threshold.
Track HTTP request body size distributions per route and alert on statistical outliers.
Watch for repeated systemd or container restarts of the Caddy service, which indicate crash-and-recover cycles.

How to Mitigate CVE-2026-92284

Immediate Actions Required

Upgrade Caddy to a version later than 2.11.3 that contains the fix referenced in GHSA-j8px-rmrx-76h9.
Remove references to the http.request.body placeholder from production configurations until the upgrade is completed.
Place a size-limiting reverse proxy or web application firewall in front of Caddy to reject oversized request bodies before they reach the server.

Patch Information

The Caddy maintainers have published a security advisory at GHSA-j8px-rmrx-76h9. Operators should apply the fixed release identified in that advisory. Container image users should rebuild or pull updated images and redeploy affected workloads.

Workarounds

Remove or comment out any directive that expands {http.request.body} in Caddyfile or JSON configuration.
Enforce a strict upstream body size limit at a load balancer, CDN, or WAF layer.
Configure the operating system to restart the Caddy service automatically to limit downtime while patching is in progress.

bash

# Caddyfile example enforcing a small request body limit on affected routes
:443 {
    request_body {
        max_size 1MB
    }
    reverse_proxy backend:8080
}