Hi,

The following vulnerability was published for caddy.

CVE-2026-55458[0]:
| Caddy is an extensible server platform that uses TLS by default.
| Prior to 2.11.5, the reverse proxy's finalizeResponse method in
| modules/caddyhttp/reverseproxy/reverseproxy.go handles an upstream
| 101 Switching Protocols response before running
| removeConnectionHeaders and the hopHeaders deletion loop used for
| ordinary responses. The early return invokes handleUpgradeResponse,
| which copies the upstream headers to the client and normalizes only
| WebSocket-specific header names. An attacker who controls or
| compromises a proxied WebSocket upstream can therefore cause hop-by-
| hop headers such as Alt-Svc, Keep-Alive, and Proxy-Authenticate, as
| well as headers named by Connection, to cross the proxy boundary.
| For HTTP/2 or HTTP/3 extended CONNECT, the upstream 101 response may
| be represented to the client as an ordinary successful response,
| increasing the chance that leaked headers are processed. This issue
| is fixed in version 2.11.5.

https://github.com/caddyserver/caddy/security/advisories/GHSA-8qx7-j2v2-x6q5
Fixed by: https://github.com/caddyserver/caddy/commit/25b3eab6dbd8d2d2670711f26b774e0fd43e1179 (v2.11.5)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-55458
https://www.cve.org/CVERecord?id=CVE-2026-55458

Please adjust the affected versions in the BTS as needed.