VulnSocial

CVE-2026-9658Disclosure

LOWCVSS 7.3 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example, GET /path\r\nHTTP/1.1\r\nHost: secret.example.com Note that it is unclear whether request paths with CRLF followed by additional headers would be blocked by reverse proxies, or how they would be processed by Plack-based servers.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-113CWE-790

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-05-29: 1Technical Details · 2026-05-29: 105-29
Signal classification1 categories
Disclosure
1100.0%
Referenced assets2 URLs
Full discourse1 post
  • Open Source Security mailing list@oss_security
    Disclosure

    Perl CPAN CVE-2026-9658: Plack::Middleware::Security::Common before 0.13.1 did not block header injections in request paths https://www.openwall.com/lists/oss-security/2026/05/28/9 CVE-2026-41565: CryptX before 0.088_001 have a stack buffer overflow in four AEAD decrypt_verify helpers https://www.openwall.com/lists/oss-security/2026/05/28/10

    Post summary

    The text announces two Perl package CVEs with brief technical details and links to Openwall mailing list posts for further information.

    10010320
    4.6K followersView on X

Explore more

Back to dashboard