CVE-2026-104380

Katalog CVE

CVSS 5.3 · Medium EPSS 0,16%

Kerentanan Missing Origin Validation in WebSockets. Skor CVSS 3.1 5.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one. On HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET and so reaches every GET route, API operation and mount. The Origin check runs only when a websocket route matches. On this transport the handler's status is the handshake response, and a 2xx accepts it. A cross-origin page can open a WebSocket to any path and learn from its open or error event whether that path returns 2xx.

Rincian

Terbit di NVD

6 Oktober 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Deferred

CVSS 3.1

5.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1385: Missing Origin Validation in WebSockets

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 5,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://metacpan.org/release/LNATION/Punk-0.55/changes
• https://metacpan.org/release/LNATION/Punk-0.55/diff/LNATION/Punk-0.54
• http://www.openwall.com/lists/oss-security/2026/10/06/1