Miyagawa
Monthly
Plack::Middleware::XSendfile through version 1.0053 allows remote unauthenticated attackers to read arbitrary files from nginx-proxied servers by injecting malicious X-Sendfile-Type and X-Accel-Mapping headers. When the middleware's sendfile type is not explicitly configured, clients can force nginx's X-Accel-Redirect mode and manipulate path mappings to access sensitive files outside intended directories. The middleware has been deprecated as of version 1.0053 and will be removed in future Plack releases. EPSS score of 0.01% suggests low current exploitation activity despite the high CVSS 9.1 rating. No public exploit code identified at time of analysis, though the attack technique mirrors the documented CVE-2025-61780 vulnerability in Rack::Sendfile.
HTTP request smuggling in Starman, the preforking Perl PSGI/Plack web server, affects all releases before 0.4018 due to incorrect header precedence (CWE-444): when a request carries both Content-Length and Transfer-Encoding: chunked, Starman honors Content-Length instead of chunked encoding, violating RFC 7230 §3.3.3. When Starman sits behind a front-end reverse proxy that resolves the ambiguity differently, an attacker can desynchronize the two parsers to smuggle requests, poison the request queue, and capture or manipulate other users' traffic. There is no public exploit identified at time of analysis, EPSS is very low (0.02%), and CISA SSVC records exploitation status as none, but a vendor patch is available in version 0.4018.
Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Plack::Middleware::XSendfile through version 1.0053 allows remote unauthenticated attackers to read arbitrary files from nginx-proxied servers by injecting malicious X-Sendfile-Type and X-Accel-Mapping headers. When the middleware's sendfile type is not explicitly configured, clients can force nginx's X-Accel-Redirect mode and manipulate path mappings to access sensitive files outside intended directories. The middleware has been deprecated as of version 1.0053 and will be removed in future Plack releases. EPSS score of 0.01% suggests low current exploitation activity despite the high CVSS 9.1 rating. No public exploit code identified at time of analysis, though the attack technique mirrors the documented CVE-2025-61780 vulnerability in Rack::Sendfile.
HTTP request smuggling in Starman, the preforking Perl PSGI/Plack web server, affects all releases before 0.4018 due to incorrect header precedence (CWE-444): when a request carries both Content-Length and Transfer-Encoding: chunked, Starman honors Content-Length instead of chunked encoding, violating RFC 7230 §3.3.3. When Starman sits behind a front-end reverse proxy that resolves the ambiguity differently, an attacker can desynchronize the two parsers to smuggle requests, poison the request queue, and capture or manipulate other users' traffic. There is no public exploit identified at time of analysis, EPSS is very low (0.02%), and CISA SSVC records exploitation status as none, but a vendor patch is available in version 0.4018.
Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.