CVE-2026-9658 Details
Description
Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example, GET /path\r\nHTTP/1.1\r\nHost: secret.example.com Note that it is unclear whether request paths with CRLF followed by additional headers would be blocked by reverse proxies, or how they would be processed by Plack-based servers.
A vulnerability exists in Plack::Middleware::Security::Common for Perl, affecting versions prior to 0.13.1. The issue allows header injections in request paths to bypass security measures, unless the injections are double-encoded. For instance, a request path could be crafted to include CRLF sequences followed by additional headers, potentially evading detection by reverse proxies or Plack-based servers.
Users can upgrade to Plack::Middleware::Security::Common version 0.13.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 28, 2026CISA-ADP
Assessed Jun 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/RRWO/Plack-Middleware-Security-Simple-v0.13.1/changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/05/28/9 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | CPANSec |
| CWE-790 | Improper Filtering of Special Elements | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Plack::Middleware::Security::Common | < 0.13.1 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | CVE Modified | CVE |
| May 28, 2026 | New CVE Received | CPANSec |