Vulnerability Description
Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example, GET /path\r\nHTTP/1.1\r\nHost: secret.example.com Note that it is unclear whether request paths with CRLF followed by additional headers would be blocked by reverse proxies, or how they would be processed by Plack-based servers.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://metacpan.org/release/RRWO/Plack-Middleware-Security-Simple-v0.13.1/chang
- http://www.openwall.com/lists/oss-security/2026/05/28/9
FAQ
What is CVE-2026-9658?
CVE-2026-9658 is a vulnerability with a CVSS score of 7.3 (HIGH). Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. The header injection rule was ineffective at blocking header injections in the re...
How severe is CVE-2026-9658?
CVE-2026-9658 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-9658?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.