onyx --cves cve-2018-19148

CVE-2018-19148

score: <0.1
cvss: 3.7
epss: 0.9%
published: 2018-11-10
kev added: —
first seen: 2026-10-21

Caddy versions up to 0.11.0 contain an information disclosure caused by serving incorrect certificates for invalid requests, letting attackers enumerate hostnames, exploit requires sending requests with non-matching Host headers.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

2018-11-10 Published
2026-10-21 Tracked by Onyx
2026-10-21 Public PoC

Exploit availability

Public PoC flagged by vulnx; no direct exploit link among the citations.

Weaknesses

CWE-200

References 4

https://securitytrails.com/blog/caddy-web-server-ssl-bug
https://github.com/mholt/caddy/issues/1303
https://github.com/mholt/caddy/issues/2334
https://github.com/mholt/caddy/pull/2015