CVE-2018-19148 json
Caddy allows enumeration of Certificates and Hostnames
published 2018-11-10 7 y ago modified 2026-06-17 4 mo ago also GHSA-jf2w-mq6r-56v8 , EUVD-2022-4337
- cvss
- 3.7
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 58%
- public exploits
- 0
- none known
Summary
Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames. Specifically, when unable to match a Host header with a vhost in its configuration, it serves the X.509 certificate for a randomly selected vhost in its configuration. Repeated requests (with a nonexistent hostname in the Host header) permit full enumeration of all certificates on the server. This generally permits an attacker to easily and accurately discover the existence of and relationships among hostnames that weren't meant to be public, though this information could likely have been discovered via other methods with additional effort.
Patch / fix
- go github.com/caddyserver/caddy 0.11.1
- github.com/caddyserver/caddy@986d4ff commit
- github.com/caddyserver/caddy@f6e5089 commit
- github.com/mholt/caddy#2015 pull request
- github.com/mholt/caddy/issues/1303 advisory
- github.com/mholt/caddy/issues/2334 advisory
- securitytrails.com/blog/caddy-web-server-ssl-bug advisory
Exploit prediction
0.86% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- securitytrails.com https://securitytrails.com/blog/caddy-web-server-ssl-bug referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 3.7 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
| GitHub | 3.0 | 3.7 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/caddyserver/caddy | <0.11.1 |
0.11.1 |
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/mholt/caddy/pull/2015
web, issue-tracking, patch, third-party-advisory
-
github.com
/mholt/caddy/issues/1303
web, issue-tracking, patch, third-party-advisory
-
github.com
/mholt/caddy/issues/2334
web, issue-tracking, patch, third-party-advisory
-
github.com
/caddyserver/caddy/commit/986d4ffe3de32dcb81d334d603a2f0f1d460eb2f
web
-
github.com
/caddyserver/caddy/commit/f6e50890b3d81cb04146bd7b2c2b59e99830849a
web
-
securitytrails.com
/blog/caddy-web-server-ssl-bug
web, exploit, patch, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2018-19148
advisory
-
github.com
/caddyserver/caddy
package
Sources
- CVE List CVE-2018-19148
- GitHub Advisory GHSA-jf2w-mq6r-56v8
- NVD CVE-2018-19148
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.