EUVD-2026-92915
GHSA-cmh9-2wr3-4x64
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to attacker cross-origin page
-
ExploitOpen WebSocket Extended CONNECT to target path
-
ExecutionHandshake matched as GET, Origin check bypassed
-
ImpactInfer endpoint 2xx status from open/error event
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Hardware safety mechanism
|
| Exploitation Conditions | Exploitation requires the target Punk instance (versions 0.48 up to but not including 0.55) to be served over HTTP/2 or HTTP/3, since the attack depends on the Extended CONNECT WebSocket handshake - it is NOT exploitable over HTTP/1.1. It further requires a victim to visit an attacker-controlled cross-origin page that scripts the WebSocket. Limiting factors: the leak is confined to revealing whether a given path returns a 2xx status (endpoint/authorization probing), with no disclosure of response content, no integrity or availability impact, and no direct attacker authentication; the Origin check functions correctly for normally-matched WebSocket routes, so only GET routes/API operations/mounts reached via the Extended-CONNECT-as-GET path are affected. |
| Impact | This is a medium-severity cross-origin information disclosure flaw (CWE-1385, Missing Origin Validation in WebSockets) with a vendor CVSS of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The real-world signals point to LOW practical priority: no EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public exploit code is referenced - exploitation status is therefore 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The technical impact is narrow: an attacker only learns whether an arbitrary path returns a 2xx response (endpoint existence/authorization probing), not the content itself, which justifies C:L and I:N/A:N. CONFLICTING SIGNAL: the NVD vector asserts UI:N, but the described attack fundamentally requires a victim to load an attacker-controlled cross-origin page, which is user interaction - this materially lowers the realistic exploitability versus a pure unauthenticated remote bug, and should be verified against the vendor advisory. Combined with the niche footprint of the affected product, this is a legitimate hardening fix rather than an urgent emergency patch. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page and lures an authenticated or network-adjacent victim into visiting it. The page opens a WebSocket (Extended CONNECT) to arbitrary paths on a Punk-based service running over HTTP/2 or HTTP/3; because the handshake is matched as a GET and the Origin check is skipped, the attacker's JavaScript observes the open/error event to map which internal endpoints return 2xx. No public proof-of-concept is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Cross-origin WebSocket probing in the Punk Perl web framework (versions 0.48 up to but not including 0.55) allows a malicious web page to learn whether arbitrary GET paths, API operations, or mounted applications return a 2xx status. When Punk serves HTTP/2 or HTTP/3, an Extended CONNECT WebSocket handshake is routed as a GET by ps_serve_one, so it reaches every GET route while the Origin check - which only runs for matched websocket routes - is skipped; the handler's returned status becomes the handshake response, and any 2xx accepts the socket. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction (UI:R): a victim must load an attacker-controlled cross-origin page that scripts the WebSocket, and it is not exploitable over HTTP/1.1. The impact is limited to endpoint and authorization probing - no response content, integrity, or availability impact - and no public exploit code was identified at time of analysis.
RemediationAI
Upgrade Punk to version 0.55 or later - the vendor-released patch is Punk 0.55, published on CPAN (https://metacpan.org/release/LNATION/Punk-0.55/changes; diff at https://metacpan.org/release/LNATION/Punk-0.55/diff/LNATION/Punk-0.54). If an immediate upgrade is not possible, the most direct compensating control is to serve the Punk application over HTTP/1.1 only, which removes the Extended CONNECT path entirely; the trade-off is losing HTTP/2 multiplexing and HTTP/3 performance benefits, and it may require configuration at the reverse proxy or TLS terminator. Alternatively, restrict which routes are reachable by untrusted cross-origin clients by fronting sensitive GET routes/API operations with explicit authorization checks that return a non-2xx status for unauthenticated callers - since the only observable signal is the status code, ensuring those paths never return 2xx to unauthorized requests neutralizes the probe (at the cost of application-level changes rather than a single framework fix). Because the defect is status-only information disclosure, network-level mitigations can be applied proportionally: rate-limit or block WebSocket/Extended CONNECT establishment to non-WebSocket paths at the edge, accepting that legitimate clients on h2/h3 may be affected if the rule is too broad. Consult the oss-security advisory (https://seclists.org/oss-sec/2026/q4/57) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-104380) for vendor guidance.
Affected ProductsAI
Punk for Perl versions 0.48 through 0.54 (i.e., from 0.48 up to, but not including, 0.55) are affected; version 0.55 is the first fixed release, and no CPE identifiers were supplied in the intelligence feed. The exposure is transport-dependent: only Punk instances served over HTTP/2 or HTTP/3 are exploitable, since the flaw requires the Extended CONNECT WebSocket handshake, which HTTP/1.1 does not use; HTTP/1.1 deployments remain unaffected by this specific issue. Vendor and community advisories are available at the Metacpan release change log (https://metacpan.org/release/LNATION/Punk-0.55/changes), the LNATION Punk 0.54→0.55 diff (https://metacpan.org/release/LNATION/Punk-0.55/diff/LNATION/Punk-0.54), the oss-security advisory (https://seclists.org/oss-sec/2026/q4/57), the Openwall thread (http://www.openwall.com/lists/oss-security/2026/10/06/1), and the NVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-104380); ENISA assigns EUVD-2026-92915 and the issue was reported by CPANSec and tagged Information Disclosure.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Punk is a Perl web framework; ps_serve_one is the request-dispatch routine that maps incoming requests onto routes, API operations, and mounted applications. On HTTP/2 and HTTP/3, WebSocket bootstrapping is expressed as an Extended CONNECT request (RFC 8441 for HTTP/2, RFC 9220 for HTTP/3) rather than an HTTP/1.1 Upgrade. Punk 0.48-0.54 match that Extended CONNECT as a plain GET, so it flows through the ordinary GET routing table instead of a dedicated websocket route. The framework's Origin validation is invoked only when a websocket route matches, so on this path the check is bypassed entirely, and because the handler's HTTP status is used as the handshake response, any 2xx result causes the WebSocket to open - the attacker-observable signal. This is CWE-1385 (Missing Origin Validation in WebSockets), a cross-origin access-control gap rather than a memory-safety or injection flaw: the affected Perl library reaches only status-level disclosure, which is why the vector is AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (vendor scoring 5.3 as AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, differing only on user interaction).
Know when Perl gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Remote unauthenticated cross-origin probe, but requires the victim to load a malicious page (UI:R) and HTTP/2/3 transport; only endpoint 2xx status leaks (C:L), with no integrity or availability impact.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
2DescriptionCVE.org
Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one.
On HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET and so reaches every GET route, API operation and mount. The Origin check runs only when a websocket route matches. On this transport the handler's status is the handshake response, and a 2xx accepts it.
A cross-origin page can open a WebSocket to any path and learn from its open or error event whether that path returns 2xx.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly hand
Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of
Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated
Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid
Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive informa
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Rated high severity (CVS
The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which mig
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mecha
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers
The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-depe
Exploit-DB