CVE-2026-9658

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-9658
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9658.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-9658
Published
2026-05-28T11:36:50.565Z
Modified
2026-08-12T03:51:22.259781451Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths
Details

Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths.

The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example,

GET /path\r\nHTTP/1.1\r\nHost: secret.example.com

Note that it is unclear whether request paths with CRLF followed by additional headers would be blocked by reverse proxies, or how they would be processed by Plack-based servers.

Database specific 
{
    "cna_assigner": "CPANSec",
    "cwe_ids": [
        "CWE-113",
        "CWE-790"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9658.json"
}
References

Affected packages

Git / github.com/robrwo/plack-middleware-security-simple

Affected ranges

Type
GIT
Repo
https://github.com/robrwo/plack-middleware-security-simple
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e099f6e2bb41baa9b32932eab835fa2d33951bc3
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.13.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v0.*
v0.10.0
v0.10.1
v0.11.0
v0.11.1
v0.12.0
v0.12.1
v0.13.0
v0.2.0
v0.2.1
v0.3.0
v0.3.1
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.5.0
v0.5.1
v0.6.0
v0.6.1
v0.7.0
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.9.0
v0.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9658.json"