CVE-2026-9658 Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths
Attackers can inject headers via request paths in Plack::Middleware::Security::Common due to ineffective CRLF blocking, potentially bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9658?
CVE-2026-9658 is a high-severity vulnerability in RRWO Plack::Middleware::Security::Common, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths.
The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example,
GET /path\r\nHTTP/1.1\r\nHost: secret.example.com
Note that it is unclear whether request paths with CRLF followed by additional headers would be blocked by reverse proxies, or how they would be processed by Plack-based servers.
Which versions are affected by CVE-2026-9658?
How do I fix CVE-2026-9658?
No fix has been published for CVE-2026-9658 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-9658 being exploited?
There is no known exploitation of CVE-2026-9658 in the wild and no public exploit code.
Sources
Also known as GHSA-xcq6-chp9-g954.