IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-05-28 13:16

MODIFIED

2026-05-28 13:16

EPSS (Prob. Exploit)

0.23%

Top 86.6%

DATA SOURCES:

NVD 🔗 2026-05-28 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-01 OSV 🔗 2026-11-02

> DESCRIPTION

Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example, GET /path\r\nHTTP/1.1\r\nHost: secret.example.com Note that it is unclear whether request paths with CRLF followed by additional headers would be blocked by reverse proxies, or how they would be processed by Plack-based servers.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-113 CWE-790

> CWE DETAILED DESCRIPTIONS

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers - The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers. | CWE-790: Improper Filtering of Special Elements - The product receives data from an upstream component, but it does not filter or incorrectly filters special elements before sending it to a downstream component.

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths

AFFECTED PACKAGES:

Unknown / Unknown

27 versions affected

> HISTORIQUE DES MODIFICATIONS

Première apparition

28/05/2026 13:16

Source: NVD

📊 ENRICHISSEMENT 01/11/2026 06:59

CWE

Champ modifié: Description CWE

Ancienne valeur:

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') - The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.)...

Nouvelle valeur:

📊 ENRICHISSEMENT 01/06/2026 06:01

CWE