Executive brief
Plack::Middleware::Security::Common is a security tool for Perl-based web applications designed to filter out malicious requests. A flaw in its filtering rules allowed attackers to bypass security checks by including special characters in the web address (URL). This could potentially allow an attacker to trick the server or a proxy into misinterpreting the request, though the practical impact depends on the specific server configuration.
Technical details
A vulnerability exists in the header_injection rule of Plack::Middleware::Security::Common where CRLF sequences in request paths were not properly neutralized. An attacker could potentially perform HTTP request splitting or injection by including double-encoded CRLF sequences (e.g., \r\n) within the URI. While the middleware is intended to block such patterns, the rule was ineffective against specific encoding variations. The impact of this bypass depends on how downstream reverse proxies or the PSGI server handle malformed request paths containing control characters. The issue is resolved in version 0.13.1.
Affected products
- RRWO Plack::Middleware::Security::Common < 0.13.1
Timeline
- 2026-05-26: patched: Version 0.13.1 released on CPAN.
- 2026-05-28: advisory: CVE-2026-9658 published.