-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stemmed from three key flaws: 1) Missing enforcement of hostname consistency between TLS SNI and HTTP Host headers, 2) Failure to require strict configuration when ClientAuth was enabled, and 3) Ambiguous ClientAuth CA pool configurations. The commit diff shows these functions were specifically modified to add StrictHostMatching enforcement, QUIC compatibility checks, and CA pool validation - indicating they were the vulnerable points. The pre-patch versions of MakeServers didn't set StrictHostMatching, serveHTTP didn't validate SNI/Host consistency, and assertConfigsCompatible didn't check CA pool conflicts.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/caddyserver/caddy | go | < 0.10.13 | 0.10.13 |
Ongoing coverage of React2Shell