Riskcovery

CVE-2026-9658

Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths

State
Published
Severity
7.3 High
Published
May 28, 2026
Updated
Jun 1, 2026
Reserved
May 26, 2026

Read the record on cve.org

Description

Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths.

The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example,

GET /path\r\nHTTP/1.1\r\nHost: secret.example.com

Note that it is unclear whether request paths with CRLF followed by additional headers would be blocked by reverse proxies, or how they would be processed by Plack-based servers.

Scores

CVSSScoreVectorSource
3.17.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LCISA-ADP

Weaknesses

  • CWE-790 Improper Filtering of Special Elements
  • CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers

Affected Products

ProductVersions
Plack::Middleware::Security::CommonRRWO
  • before 0.13.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.