Plack::Middleware::Security::Common CVE-2026-9658

Exploitation requires that the target Perl web application uses Plack::Middleware::Security::Common (any version below 0.13.1) and relies on its header-injection rule as a security boundary; the attacker sends a request path containing raw or single-encoded CRLF (\r\n / %0D%0A) rather than double-encoded sequences. Realized impact further depends on the deployment stack - specifically how the fronting reverse proxy normalizes or forwards CRLF in paths and how the underlying Plack server (e.g., Starman, Gazelle, Twiggy) parses the smuggled bytes - which the CVE description explicitly flags as uncertain. No authentication or user interaction is needed (PR:N/UI:N), but applications that do not deploy this middleware, or that already strip CRLF at the proxy, are not exposed.

The CVSS vector AV:N/AC:L/PR:N/UI:N rates this as remotely exploitable with no authentication, but the C:L/I:L/A:L impact reflects partial - not full - compromise, yielding the 7.3 score. EPSS at 0.03% (9th percentile) and the absence of KEV listing or known public exploit point to low real-world targeting pressure, and the CVE description itself notes uncertainty about whether downstream reverse proxies or Plack servers actually act on the injected headers - so the practical impact is conditional on the deployment stack. This is best treated as a defense-in-depth control failure (a security middleware that did not enforce as advertised) rather than a critical RCE-class issue; prioritize patching but it is not an emergency for most defenders.

An attacker sends a crafted HTTP request such as GET /path\r\nHTTP/1.1\r\nHost: secret.example.com to a Plack-based application protected by Plack::Middleware::Security::Common, expecting the middleware to block it. Because the injection filter only catches double-encoded CRLF, the request passes through, and depending on how the front-end proxy and Plack handler interpret the embedded CRLF the attacker may achieve request smuggling, cache poisoning, or routing to an unintended Host. No public exploit is identified at time of analysis.