A memory exhaustion vulnerability in Caddy allows unauthenticated attackers to cause a denial of service by sending specifically crafted requests that exceed resource limits.

This vulnerability, categorized as CWE-770 (Allocation of Resources Without Limits or Throttling), occurs because the server reads the entire request body before middleware limits are applied. An unauthenticated attacker can trigger this by sending large request bodies, leading to process termination.

The primary impact of this vulnerability is a denial of service, which can cause significant disruption to web services relying on the Caddy platform. While the CVSS score of 6.9 reflects a medium severity, the ability for an unauthenticated attacker to remotely crash a production server presents a tangible risk to operational availability and business continuity.

Immediate Action: Update Caddy to version 2.11.4 or later immediately to apply the necessary resource limits.

Proactive Monitoring: Monitor server logs and resource utilization metrics for spikes in memory consumption or frequent, unexplained process restarts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to enforce strict request body size limits, preventing oversized payloads from reaching the vulnerable component.

Public Exploit Available: No confirmed public exploit (exploit_available: unknown).

Given the availability of a patch and the potential for service disruption, administrators should prioritize upgrading to Caddy version 2.11.4. Implementing these updates is essential to prevent potential denial of service attacks that could take critical infrastructure offline.