CVE-2026-9658: Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths

Synopsis

This is a header injection vulnerability in Plack::Middleware::Security::Common, a Perl security middleware for Plack-based web applications, affecting all versions before 0.13.1. The flaw is reachable over the network with no authentication required, meaning any client that can send HTTP requests to the application can attempt exploitation. Successful exploitation allows an attacker to inject arbitrary HTTP headers or manipulate request routing, potentially leading to limited disclosure, tampering with request data, and minor service disruption. A patched-image rebuild at version 0.13.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the application over the network by sending a crafted HTTP request to the exposed service.

• AuthenticationNot required

  No credentials or account are needed; any unauthenticated client that can send HTTP requests to the server can attempt the injection.

• Victim interactionNot required

  No user action is required; the attacker sends the malicious request directly to the server without involving any end user.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions or special environmental setup beyond network access to the target.

Blast Radius

• Attacker injects arbitrary HTTP headers into server-side request processing, potentially influencing downstream proxy or application logic.
• Attacker reads portions of response data or internal routing information exposed through header manipulation, achieving limited confidentiality impact.
• Attacker modifies how requests are interpreted or forwarded, tamping with application-layer behavior at a limited scope.
• Attacker may cause minor disruption to request handling or routing, degrading service availability in a limited way.