CVE-2026-55458

Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through

Published

2026-10-28

Modified

2026-10-28

Aliases

GHSA-8qx7-j2v2-x6q5

Sources

github-advisory

Summary

### AI Disclosure This vulnerability was discovered via deepseek-v4-pro[1m] for finding potential vulnerabilities / inconsistencies in the code base. I made the AI check if Caddy is compliant with various RFCs, incl. 7230. I also used it to help write the PoC, since it was honestly much faster than writing it by hand. I also let it write parts of this advisory text for brevity's sake, but had to rewrite half of it by hand. ### Summary Caddy's reverse proxy fails to strip RFC 7230 hop-by-hop headers from upstream responses when handling WebSocket upgrades (HTTP 101 Switching Protocols). Headers including `Alt-Svc`, `Keep-Alive`, `Proxy-Authenticate`, `Transfer-Encoding`, or `Trailer`, which Caddy actually correctly strips for normal HTTP responses, pass through unfiltered to the client during protocol upgrades. An upstream that sets these headers (intentionally or otherwise) can inject them into client responses, enabling connection hijacking via `Alt-Svc`, cookie injection via `Set-Cookie`, and proxy authentication phishing. The normal response path in `finalizeResponse` correctly strips all hop-by-hop headers before forwarding, but the 101 code path returns early, skipping the stripping entirely. ### Details In `modules/caddyhttp/reverseproxy/reverseproxy.go`, the `finalizeResponse` method (line 1178) handles upstream responses. For all normal responses, it strips hop-by-hop headers before copying to the client: ```go // reverseproxy.go:1194-1198 removeConnectionHeaders(res.Header) for _, h := range hopHeaders { res.Header.Del(h) } ``` However, the 101 Switching Protocols check at line 1187 returns before this stripping code: ```go // reverseproxy.go:1186-1192 if res.StatusCode == http.StatusSwitchingProtocols { var wg sync.WaitGroup h.handleUpgradeResponse(logger, &wg, rw, req, res) wg.Wait() return nil // headers stripped Upgrade (101): `handleUpgradeResponse()` runs, returns early -> headers are NOT stripped This is the only response code path in the reverse proxy that bypasses hop-by-hop header stripping. ### PoC Caddy config: ``` :8080 { reverse_proxy localhost:8083 } ``` Script: ```python import socket UPSTREAM = ( b"HTTP/1.1 101 Switching Protocols\r\n" b"Upgrade: websocket\r\n" b"Connection: Upgrade\r\n" b"Sec-WebSocket-Accept: s3pPLMBiTxaQ9kYGzzhZRbK+xOo=\r\n" b"Alt-Svc: h2=\"attacker.example.com:443\"; ma=86400\r\n" b"Keep-Alive: timeout=999\r\n" b"Proxy-Authenticate: Basic realm=\"phish\"\r\n" b"Set-Cookie: injected=malicious; Path=/\r\n" b"\r\n" ) s = socket.socket() s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) s.bind(("

Affected packages

Remediation: Upgrade to 2.11.5 or later.

References

• https://github.com/advisories/GHSA-8qx7-j2v2-x6q5