Path Confusion

🗓️ 03 May 2026 19:11:39Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 4 Views

Caddy FastCGI path confusion from lowercasing before offset calc; misreports SCRIPT_NAME and PATH_INFO for Unicode paths.

Reporter	Title	Published	Views	Family All 124
ATTACKERKB	CVE-2026-27590	24 Feb 202616:33	–	attackerkb
AlpineLinux	CVE-2026-27590	24 Feb 202616:33	–	alpinelinux
Information Security Automation	March Linux Patch Wednesday	30 Mar 202620:00	–	avleonov
Circl	CVE-2026-27590	23 Feb 202604:22	–	circl
CNNVD	Caddy 安全漏洞	24 Feb 202600:00	–	cnnvd
CVE	CVE-2026-27590	24 Feb 202616:33	–	cve
Cvelist	CVE-2026-27590 Caddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport	24 Feb 202616:33	–	cvelist
Debian CVE	CVE-2026-27590	24 Feb 202616:33	–	debiancve
Github Security Blog	Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport	24 Feb 202620:39	–	github
NVD	CVE-2026-27590	24 Feb 202617:29	–	nvd

Vulners

Node

caddy_project caddyMatch2.10.2-r5go

AND

caddy_project caddyMatch2.10.2-r3go

AND

caddy_project caddyMatch2.10.2-r2go

AND

caddy_project caddyMatch2.10.2-r4go

AND

caddy_project caddyMatch2.10.2-r1go

AND

alpinelinux alpine_linuxMatch3.23

caddy_project caddyMatch2.7.4-r0go

AND

caddy_project caddyMatch2.6.4-r6go

AND

caddy_project caddyMatch2.7.6-r6go

AND

caddy_project caddyMatch2.5.2-r3go

AND

caddy_project caddyMatch2.10.0-r1go

AND

caddy_project caddyMatch2.7.6-r5go

AND

caddy_project caddyMatch2.10.2-r1go

AND

caddy_project caddyMatch2.7.6-r7go

AND

caddy_project caddyMatch2.4.1-r1go

AND

caddy_project caddyMatch2.4.5-r1go

AND

caddy_project caddyMatch2.8.4-r1go

AND

caddy_project caddyMatch2.6.0-r0go

AND

caddy_project caddyMatch2.7.6-r0go

AND

caddy_project caddyMatch2.4.2-r0go

AND

caddy_project caddyMatch2.7.4-r1go

AND

caddy_project caddyMatch2.4.3-r0go

AND

caddy_project caddyMatch2.8.4-r0go

AND

caddy_project caddyMatch1.0.4-r3go

AND

caddy_project caddyMatch2.6.1-r1go

AND

caddy_project caddyMatch2.9.1-r0go

AND

caddy_project caddyMatch2.6.4-r3go

AND

caddy_project caddyMatch2.7.6-r1go

AND

caddy_project caddyMatch2.6.2-r1go

AND

caddy_project caddyMatch2.7.3-r0go

AND

caddy_project caddyMatch2.10.2-r3go

AND

caddy_project caddyMatch2.10.2-r2go

AND

caddy_project caddyMatch2.4.6-r0go

AND

caddy_project caddyMatch2.9.1-r2go

AND

caddy_project caddyMatch2.10.2-r4go

AND

caddy_project caddyMatch2.6.2-r3go

AND

caddy_project caddyMatch2.6.4-r1go

AND

caddy_project caddyMatch2.3.0-r0go

AND

caddy_project caddyMatch2.6.3-r0go

AND

caddy_project caddyMatch2.7.6-r2go

AND

caddy_project caddyMatch2.8.4-r2go

AND

caddy_project caddyMatch2.10.0-r3go

AND

caddy_project caddyMatch2.5.1-r1go

AND

caddy_project caddyMatch2.5.2-r2go

AND

caddy_project caddyMatch2.10.0-r2go

AND

caddy_project caddyMatch2.6.4-r2go

AND

caddy_project caddyMatch2.7.5-r0go

AND

caddy_project caddyMatch2.4.0-r0go

AND

caddy_project caddyMatch2.4.6-r2go

AND

caddy_project caddyMatch2.6.2-r0go

AND

caddy_project caddyMatch2.9.1-r3go

AND

caddy_project caddyMatch2.6.4-r4go

AND

caddy_project caddyMatch2.4.5-r0go

AND

caddy_project caddyMatch2.7.6-r3go

AND

caddy_project caddyMatch2.5.1-r0go

AND

caddy_project caddyMatch2.8.4-r3go

AND

caddy_project caddyMatch2.10.0-r0go

AND

caddy_project caddyMatch2.7.6-r4go

AND

caddy_project caddyMatch2.5.2-r0go

AND

caddy_project caddyMatch2.6.4-r5go

AND

caddy_project caddyMatch2.5.0-r0go

AND

caddy_project caddyMatch2.6.2-r2go

AND

caddy_project caddyMatch2.4.1-r0go

AND

caddy_project caddyMatch2.6.1-r0go

AND

caddy_project caddyMatch1.0.4-r2go

AND

caddy_project caddyMatch2.5.2-r1go

AND

caddy_project caddyMatch2.9.1-r1go

AND

caddy_project caddyMatch2.4.6-r3go

AND

caddy_project caddyMatch2.10.2-r0go

AND

alpinelinux alpine_linuxMatchedge

caddyserver github.com/caddyserver/caddyRangev2.0.0-beta1–2.0.0-beta1go

Source	Link
github	www.github.com/caddyserver/caddy/commit/7c28c0c07ac70a8960a166c7126150a408ba7464
secdb	www.secdb.alpinelinux.org/v3.23/community.yaml
github	www.github.com/caddyserver/caddy/security/advisories/GHSA-5r3v-vc8m-m96g

15 May 2026 08:06Current

7.3High risk

Vulners AI Score7.3

CVSS 3.19.8

CVSS 49.3

EPSS0.00245

SSVC