CVE-2026-9658CWE-113CWE-790

Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths

High · published May 28, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
13.3
In the wild
Unconfirmed
What it is

Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths.

The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example,

GET /path\r\nHTTP/1.1\r\nHost: secret.example.com

Note that it is unclear whether request paths with CRLF followed by additional headers would be blocked by reverse proxies, or how they would be processed by Plack-based servers.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00226 · 13.3th percentile
Weaknesses
CWE-113 · Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'); CWE-790 · Improper Filtering of Special Elements
Published
2026-05-28T11:36Z
EPSS history
Timeline
  • 28 MAY 11:36Z
    Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths
    cvelistv5