{"id":"GO-2026-6874","summary":"Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through in github.com/caddyserver/caddy","details":"Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through in github.com/caddyserver/caddy","aliases":["CVE-2026-55458","GHSA-8qx7-j2v2-x6q5"],"modified":"2026-11-05T23:15:18.153473464Z","published":"2026-11-05T22:54:32Z","database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-6874","review_status":"REVIEWED"},"references":[{"type":"ADVISORY","url":"https://github.com/caddyserver/caddy/security/advisories/GHSA-8qx7-j2v2-x6q5"},{"type":"WEB","url":"https://github.com/caddyserver/caddy/releases/tag/v2.11.5"}],"affected":[{"package":{"name":"github.com/caddyserver/caddy/v2","ecosystem":"Go","purl":"pkg:golang/github.com/caddyserver/caddy/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.11.5"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6874.json"}}],"schema_version":"1.9.2"}