CVE-2026-9658
Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example, GET /path\r\nHTTP/1.1\r\nHost: secret.example.com Note that it is unclear whether request paths with CRLF followed by additional headers would be blocked by reverse proxies, or how they would be processed by Plack-based servers.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- EPSS probability
- 0.23%
- CWE
- CWE-790, CWE-113
- Published
- 2026-05-28
- Last modified
- 2026-06-01
Affected products
- RRWO Plack::Middleware::Security::Common
Weakness type
Related vulnerabilities
- CVE-2026-11331 — Potential wildcard CNAME RPZ policy bypass
- CVE-2026-2328 — Backend Access Due to Insufficient Input Validation
- CVE-2025-27260 — Ericsson Indoor Connect 8855 - Improper Filtering of Special Elements Vulnerability
- CVE-2025-15576 — Jail chroot escape via fd exchange with a different jail
- CVE-2025-0431 — Enterprise Protection Backslash URL Rewrite Bypass
- CVE-2024-47984 — Dell RecoverPoint for Virtual Machines 6.0.x contains Denial of Service vulnerability. A User with...
- CVE-2024-42416 — Multiple issues in ctl(4) CAM Target Layer
- CVE-2024-43443 — Stored XSS in process management