It describes a reverse-proxy issue in which hop-by-hop headers from an upstream response can pass through Caddy during a WebSocket upgrade.
The advisory lists Caddy versions through v2.11.4 as affected and v2.11.5 as patched. On the HTTP 101 Switching Protocols path, Caddy returns before the header-removal logic used for normal responses. The source names headers including Alt-Svc, Keep-Alive, Proxy-Authenticate, Transfer-Encoding, and Trailer.
According to the advisory, HTTP/2 and HTTP/3 WebSocket handling can convert the upstream 101 response into a 200 response for clients. The report describes possible header injection consequences and identifies CWE-444 as the closest fit. It does not establish that any deployment was exploited or that a particular upstream application has been compromised.