CVE-2026-75922

Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line. PSGI hands PATH_INFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it. The proxy appends that byte string to the upstream base URL, and for an Upgrade tunnel writes it into a request line it serializes itself, re-encoding nothing in either path. The HTTP client that sends the resulting URL does not validate the target either. A path containing %0d%0a therefore arrives at the upstream as a CRLF that ends the request line, and a decoded space, '?' or '#' truncates it the same way. Everything the client writes after the CRLF is read by the upstream as a second request. On the buffered path it arrives on a keep-alive connection the proxy pools and reuses for other clients. Its method, path and headers are all chosen by the client, and the upstream attributes it to the proxy, so it reaches upstream paths that the proxy's own routing does not expose.

• CWE-93
• CWE-444

• https://metacpan.org/release/LNATION/Reverse-Proxy-0.03/source/Proxy.xs#L386-399
• https://metacpan.org/release/LNATION/Reverse-Proxy-0.03/source/Proxy.xs#L654-666
• https://metacpan.org/release/LNATION/Reverse-Proxy-0.04/changes
• https://metacpan.org/release/LNATION/Reverse-Proxy-0.04/source/Proxy.xs#L400-426
• https://www.openwall.com/lists/oss-security/2026/08/23/2

Published

Aug 23, 2026

Last Modified

Aug 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75917SiYuan before v3.7.4 contains a cross-site scripting vulnera…8.6
• CVE-2026-75918phpMyFAQ before 4.1.7 stores password reset tokens in a publ…8.8
• CVE-2026-75919phpMyFAQ before 4.1.7 contains an authentication bypass vuln…5.3
• CVE-2026-7592A weakness has been identified in itsourcecode Courier Manag…7.3
• CVE-2026-75920phpMyFAQ before v4.1.6 writes content backup ZIP archives to…5.3
• CVE-2026-75921The Master Addons for Elementor – Elementor Addons, Widgets,…7.2
• CVE-2026-75924A flaw was found in managed-serviceaccount. A compromised ad…8.7
• CVE-2026-75925Improper neutralization of CRLF sequences in IXON VPN Client…9.6
• CVE-2026-75926Hugo 0.161.0 placed the Node asset pipelines behind the Node…8.6
• CVE-2026-75927The PublishPress Capabilities – User Role Editor, Access Per…7.2
• CVE-2026-75928The Brushfire platform's video content streaming application…5.3
• CVE-2026-7593A security vulnerability has been detected in Sunwood-ai-lab…7.3