CVE-2026-9658
Last modified
CVE-2026-9658 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example, GET /path\r\nHTTP/1.1\r\nHost: secret.example.com Note that it is unclear whether request paths with CRLF followed by additional headers would be blocked by reverse proxies, or how they would be processed by Plack-based servers.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example, GET /path\r\nHTTP/1.1\r\nHost: secret.example.com Note that it is unclear whether request paths with CRLF followed by additional headers would be blocked by reverse proxies, or how they would be processed by Plack-based servers.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-9658?
How severe is CVE-2026-9658?
How do I fix CVE-2026-9658?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-96572The WP Meteor Website Speed Optimization Addon plugin for Wo…7.2
- CVE-2026-96573The Appointment Hour Booking – Booking Calendar plugin for W…7.2
- CVE-2026-96574The User Frontend – Membership, User Registration, User Prof…6.4
- CVE-2026-96575The Transliterator – Multilingual and Multi-script Text Conv…7.2
- CVE-2026-96577A flaw was found in oc-mirror. During mirroring operations, …7.1
- CVE-2026-96578The GSpeech TTS – WordPress Text To Speech Plugin plugin for…7.2
- CVE-2026-96580Gitea expanded a workflow's static `strategy.matrix` into it…7.5
- CVE-2026-96581Authorization Bypass Through User-Controlled Key vulnerabili…7.6
- CVE-2026-96582A HID report descriptor is a sequence of items, each declari…4.9
- CVE-2026-96587The Viidure Android application embeds permanent, plaintext …10
- CVE-2026-96589When a private repository is transferred to a user who lacks…4.3
- CVE-2026-9659Multiple exploitable stack-based buffer overflow vulnerabili…9.1
Are you affected by CVE-2026-9658?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST