What is the CVSS score of CVE-2026-75922?

CVE-2026-75922 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Reverse::Proxy CVE-2026-75922

EUVD-2026-64662 MEDIUM

HTTP Request/Response Smuggling (CWE-444)

2026-08-23 CPANSec

GHSA-5xq5-hx4g-f5v6

Request Smuggling Information Disclosure

5.3

CVSS 3.1 · Vendor: CPANSec

Severity by source

Vendor (CPANSec) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

7.2 HIGH

Scope changed because injected requests reach upstream servers beyond the proxy's security boundary; low confidentiality and integrity impact on those upstream systems; no availability impact described.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 25, 2026 - 20:27 vuln.today

CVSS changed

Aug 25, 2026 - 20:22 NVD

5.3 (None) 5.3 (MEDIUM)

CVE Published

Aug 23, 2026 - 18:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line.

PSGI hands PATH_INFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it. The proxy appends that byte string to the upstream base URL, and for an Upgrade tunnel writes it into a request line it serializes itself, re-encoding nothing in either path. The HTTP client that sends the resulting URL does not validate the target either. A path containing %0d%0a therefore arrives at the upstream as a CRLF that ends the request line, and a decoded space, '?' or '#' truncates it the same way.

Everything the client writes after the CRLF is read by the upstream as a second request. On the buffered path it arrives on a keep-alive connection the proxy pools and reuses for other clients. Its method, path and headers are all chosen by the client, and the upstream attributes it to the proxy, so it reaches upstream paths that the proxy's own routing does not expose.

AnalysisAI

HTTP request smuggling in the Perl CPAN module Reverse::Proxy (versions before 0.04) allows unauthenticated remote attackers to inject arbitrary HTTP requests to upstream servers by embedding CRLF sequences in percent-encoded URL paths. The PSGI specification requires servers to percent-decode PATH_INFO before handing it to the application, meaning %0d%0a has already become a literal carriage return and line feed by the time the proxy appends it to the upstream request line - terminating that line early and promoting everything that follows to a second, attacker-controlled request. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Send crafted URL with %0d%0a in path

Delivery

PSGI server percent-decodes PATH_INFO before proxy sees it

Exploit

Proxy writes raw CRLF into upstream request line

Execution

Upstream parser treats CRLF as request-line terminator

Persist

Attacker-controlled headers sent as second request on pooled connection

Impact

Upstream serves restricted path bypassing proxy routing

Access

Send crafted URL with %0d%0a in path

Delivery

PSGI server percent-decodes PATH_INFO before proxy sees it

Exploit

Proxy writes raw CRLF into upstream request line

Execution

Upstream parser treats CRLF as request-line terminator

Persist

Attacker-controlled headers sent as second request on pooled connection

Impact

Upstream serves restricted path bypassing proxy routing

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the target deploy Reverse::Proxy (Perl CPAN) in version 0.03 or earlier within a PSGI-compliant application stack - any conforming PSGI server (Plack/PSGI, Starman, Twiggy) will percent-decode PATH_INFO as the specification requires, satisfying the precondition. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS 5.3 score (Medium, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) understates real-world impact: it scores scope as unchanged and integrity as none, yet the described attack reaches upstream paths outside the proxy's routing boundary - a scope change - and can POST attacker-chosen payloads to those paths - an integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker sends a GET request to the proxy with a URL such as /legitimate%2fpath%0d%0aGET%20/admin%20HTTP/1.1%0d%0aHost:%20upstream-internal%0d%0a%0d%0a. The PSGI server decodes this to a raw PATH_INFO containing a CRLF sequence before the proxy processes it. …
Remediation	Upgrade to Reverse::Proxy version 0.04, which re-encodes PATH_INFO before writing it into the upstream request line; the corrected code is visible at https://metacpan.org/release/LNATION/Reverse-Proxy-0.04/source/Proxy.xs#L400-426 and the changelog confirming the fix is at https://metacpan.org/release/LNATION/Reverse-Proxy-0.04/changes. … Detailed patch versions, workarounds, and compensating controls in full report.