CVE-2026-9658

Katalog CVE

CVSS 7.3 · High EPSS 0,34%

Kerentanan Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'). Skor CVSS 3.1 7.3 (High) menurut CISA ADP.

Deskripsi (NVD)

Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example, GET /path\r\nHTTP/1.1\r\nHost: secret.example.com Note that it is unclear whether request paths with CRLF followed by additional headers would be blocked by reverse proxies, or how they would be processed by Plack-based servers.

Rincian

Terbit di NVD

28 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

7.3 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
CWE-790: Improper Filtering of Special Elements

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://metacpan.org/release/RRWO/Plack-Middleware-Security-Simple-v0.13.1/changes
• http://www.openwall.com/lists/oss-security/2026/05/28/9