The vulnerability causes Caddy’s HTTP host matcher to become case‑sensitive when configured with more than a hundred host entries, contrary to its documentation of being case‑insensitive. This issue is an instance of CWE‑178, improper case handling. As a result, an attacker can craft a Host header that differs only in letter casing from an expected value, causing the request to be directed to a different route or to bypass access controls tied to the intended route. This enables unauthorized access or manipulation of requests that would normally be restricted, effectively granting elevated privileges or unauthorized data exposure.

The issue affects all installations of Caddy server (caddyserver caddy) running versions prior to 2.11.1. Any configuration that lists more than 100 host entries is vulnerable, regardless of operating system or deployment method.

The assessment assigns a CVSS v3 score of 7.7, indicating a high severity with potential for privilege escalation and data compromise. The EPSS score is less than 1%, suggesting a low likelihood of exploitation at present. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. Exploitation would require remote network access to the Caddy instance and the ability to send HTTP requests with a manipulated Host header; no local privilege or additional authentication is required. The attack vector is therefore external to the server, using standard network protocols.