Server-Side Request Forgery in Plack::App::Prerender for Perl (CVE-2026-17552)

Plack::App::Prerender before version 0.3.0 can proxy requests to an arbitrary host due to unvalidated REQUEST_URI concatenation in the call method. When the rewrite base is a plain string, an attacker can submit a request target beginning with an at-sign ('@'), causing the rewrite base hostname to be interpreted as a RFC 3986 userinfo component and redirecting the request to an attacker-controlled host. This allows an attacker to access internal or restricted hosts that only the webserver can reach. Affected versions: - before 0.3.0 We recommend updating to: 0.3.0. CVSS 9.1 · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/291 Details: https://vuln.today/cve/CVE-2026-17552