-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from Caddy's TLS handshake behavior when encountering unmatched Host headers. The key functions in caddytls/handshake.go: 1) getCertificate() previously selected a random certificate from a global cache when no SNI match was found, as shown by the commit diff removing 'default certificate' fallback logic. 2) getCertDuringHandshake() facilitated this by not properly restricting certificate selection. The patch introduced certificate cache restructuring and strict SNI matching, confirming these functions' role in the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/caddyserver/caddy | go | < 0.11.1 | 0.11.1 |
A Semantic Attack on Google Gemini - Read the Latest Research