When per_host is enabled in Caddy's metrics configuration, the Host header (from r.Host) is used directly as a label in Prometheus metrics without any validation or length restriction. This allows users to generate high cardinality metrics by sending requests with extremely long Host headers (I faced 25k+ strings), causing excessive memory consumption in Prometheus instances.

I think the problem caused by this

if h.metrics.PerHost {
    labels["host"] = strings.ToLower(r.Host)
    statusLabels["host"] = strings.ToLower(r.Host) // without length restriction
}

Maybe it should be limited in length?

Reproduce Caddyfile

{
	metrics {
		per_host
	}
}

// For regulatory reasons, I need to avoid returning 308 redirects to non-whitelisted domains
:80 {
	respond "MUST Match Host" 403 {
		close
	}
}

https://example.com {
    ...
}