/ 
Plack-Middleware-Security-Simple-v0.5.1
⭐ Starred 2
Security Advisories (1)
CVE-2026-9658 (2026-05-28)

Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example, GET /path\r\nHTTP/1.1\r\nHost: secret.example.com Note that it is unclear whether request paths with CRLF followed by additional headers would be blocked by reverse proxies, or how they would be processed by Plack-based servers.

Changes for version v0.5.1 - 2022-02-18

  • Enhancements
    • Add fake_extensions and protocol_in_path_or_referer rules.
  • Documentation
    • Bump copyright year.
    • Fix typo in Plack::Middleware::Security::Common POD.
    • Added note that this will not protect against exploits on proxies that are in front of the PSGI application.

Documentation

README.md

Modules

Plack::Middleware::Security::Common
A simple security filter for with common rules.
Plack::Middleware::Security::Simple
A simple security filter for Plack

Other files