Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths

published 2026-05-28 5 mo ago modified 2026-10-26 13 d ago also EUVD-2026-32892

cvss: 7.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits: 0; none known

Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths.

The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example,

GET /path\r\nHTTP/1.1\r\nHost: secret.example.com

Note that it is unclear whether request paths with CRLF followed by additional headers would be blocked by reverse proxies, or how they would be processed by Plack-based servers.

Patch / fix

fixed in 1

RRWO Plack::Middleware::Security::Common 0.13.1

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 5 mo ago (2026-06-01)

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA	3.1	7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

RRWO Plack::Middleware::Security::Common

Classification

Weakness

CWE-790 Improper Filtering of Special Elements
CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers

References

Sources

CVE List CVE-2026-9658
NVD CVE-2026-9658

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary