Is CVE-2026-55458 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55458 being exploited in the wild.

How severe is CVE-2026-55458?

Medium severity, with a CVSS score of 4, published 5 November 2026.

Which products and versions are affected?

Caddy <=v2.11.4; github.com/caddyserver/caddy/v2 (Go) <= 2.11.4, SEMVER:introduced=0,fixed=2.11.5.

Is there a fix for CVE-2026-55458?

Yes. github.com/caddyserver/caddy/v2 (Go): upgrade to 2.11.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55458 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55458?

Check whether you run Caddy or github.com/caddyserver/caddy/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55458: Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through

Q: Which products and versions are affected?

Caddy <=v2.11.4; github.com/caddyserver/caddy/v2 (Go) <= 2.11.4, SEMVER:introduced=0,fixed=2.11.5.

Q: Is there a fix for CVE-2026-55458?

Yes. github.com/caddyserver/caddy/v2 (Go): upgrade to 2.11.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55458 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-55458?

Check whether you run Caddy or github.com/caddyserver/caddy/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55458 · Severity: medium · CVSS 4 · Published 2026-11-05

Caddy is a reverse proxy that routes web traffic between clients and upstream servers. When handling WebSocket upgrade connections, Caddy fails to strip RFC 7230 hop-by-hop headers (such as Alt-Svc and Proxy-Authenticate) that should never be forwarded to clients. An attacker controlling an upstream server can inject these headers to hijack client connections, inject cookies, or phish for proxy authentication credentials.

Technologies: Caddy, github.com/caddyserver/caddy/v2 (Go). Vendors: Caddy, Go.

Quick answers

Is CVE-2026-55458 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55458 being exploited in the wild.
How severe is CVE-2026-55458?: Medium severity, with a CVSS score of 4, published 5 November 2026.
Which products and versions are affected?: Caddy <=v2.11.4; github.com/caddyserver/caddy/v2 (Go) <= 2.11.4, SEMVER:introduced=0,fixed=2.11.5.
Is there a fix for CVE-2026-55458?: Yes. github.com/caddyserver/caddy/v2 (Go): upgrade to 2.11.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55458 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55458?: Check whether you run Caddy or github.com/caddyserver/caddy/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/caddyserver/caddy/v2 (Go): upgrade to 2.11.5 or later
```
go get github.com/caddyserver/caddy/v2@v2.11.5
```

Technical details

Caddy's reverse proxy correctly removes hop-by-hop headers for normal HTTP responses via the finalizeResponse method, but the HTTP 101 Switching Protocols code path returns early, bypassing header stripping entirely. In handleUpgradeResponse, all upstream headers are copied to the client without filtering. For HTTP/2 and HTTP/3, the 101 response is converted to 200 OK, causing browsers to process malicious headers like Alt-Svc and Set-Cookie. An unauthenticated attacker with control over an upstream server can inject these headers during WebSocket upgrade requests.

Affected products

Caddy Caddy <=v2.11.4

Identifiers

CVE-2026-55458
GHSA-8qx7-j2v2-x6q5
GO-2026-6874

Timeline

2026-10-28: disclosed
2026-10-28: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.