CVE-2026-75922

{"id": "CVE-2026-75922", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75922", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T19:30:17.806527Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"modules": ["Reverse::Proxy"], "versions": [{"status": "affected", "version": "0", "lessThan": "0.04", "versionType": "custom"}], "packageURL": "pkg:cpan/Reverse-Proxy", "packageName": "Reverse-Proxy", "programFiles": ["Proxy.xs"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "rp_target_url"}, {"name": "rp_raw_request"}]}]}], "published": "2026-08-23T19:16:28.930", "references": [{"url": "https://metacpan.org/release/LNATION/Reverse-Proxy-0.03/source/Proxy.xs#L386-399", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/LNATION/Reverse-Proxy-0.03/source/Proxy.xs#L654-666", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/LNATION/Reverse-Proxy-0.04/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/LNATION/Reverse-Proxy-0.04/source/Proxy.xs#L400-426", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/23/2", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-93"}, {"lang": "en", "value": "CWE-444"}]}], "descriptions": [{"lang": "en", "value": "Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line.\n\nPSGI hands PATH_INFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it. The proxy appends that byte string to the upstream base URL, and for an Upgrade tunnel writes it into a request line it serializes itself, re-encoding nothing in either path. The HTTP client that sends the resulting URL does not validate the target either. A path containing %0d%0a therefore arrives at the upstream as a CRLF that ends the request line, and a decoded space, '?' or '#' truncates it the same way.\n\nEverything the client writes after the CRLF is read by the upstream as a second request. On the buffered path it arrives on a keep-alive connection the proxy pools and reuses for other clients. Its method, path and headers are all chosen by the client, and the upstream attributes it to the proxy, so it reaches upstream paths that the proxy's own routing does not expose."}, {"lang": "es", "value": "Las versiones de Reverse::Proxy anteriores a la 0.04 para Perl permiten el contrabando de solicitudes HTTP a trav\u00e9s de un PATH_INFO decodificado por porcentaje, escrito sin codificar en la l\u00ednea de solicitud ascendente.\n\nPSGI entrega PATH_INFO a una aplicaci\u00f3n decodificado por porcentaje, por lo que una secuencia %XX en la URL del cliente se ha convertido en un byte sin procesar para cuando el proxy la ve. El proxy a\u00f1ade esa cadena de bytes a la URL base ascendente, y para un t\u00fanel de actualizaci\u00f3n lo escribe en una l\u00ednea de solicitud que serializa \u00e9l mismo, sin recodificar nada en ninguna de las rutas. El cliente HTTP que env\u00eda la URL resultante tampoco valida el objetivo. Una ruta que contiene %0d%0a, por lo tanto, llega al ascendente como un CRLF que termina la l\u00ednea de solicitud, y un espacio decodificado, '?' o '#' lo trunca de la misma manera.\n\nTodo lo que el cliente escribe despu\u00e9s del CRLF es le\u00eddo por el ascendente como una segunda solicitud. En la ruta almacenada en b\u00fafer, llega en una conexi\u00f3n keep-alive que el proxy agrupa y reutiliza para otros clientes. Su m\u00e9todo, ruta y encabezados son todos elegidos por el cliente, y el ascendente lo atribuye al proxy, por lo que alcanza rutas ascendentes que el propio enrutamiento del proxy no expone."}], "lastModified": "2026-10-14T13:10:00.187", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}