Caddy processes the {http.request.body} placeholder by copying the entire request body with an unbounded io.Copy operation before any request‑body middleware limits are applied. This flaw allows an attacker to send a very large body, consuming excessive memory and eventually terminating the Caddy process, resulting in a denial‑of‑service condition. The impact is limited to the affected instance of the server, causing it to stop handling requests until it is restarted.

The vulnerability affects Caddy server version 2.11.3 and earlier. Attackers may target any publicly exposed instance running those releases.

The CVSS score of 6.9 indicates a medium severity flaw. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote and requires an attacker to craft an HTTP request with a very large body, as the replacer logic is executed for any request that resolves the placeholder. No additional authentication or privilege is needed, making exploitation straightforward once network connectivity is possible.