Re: CVE-2026-85491: Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone

As cited

Copy frozen at 2026-09-25 03:53 UTC (site build).

vulnerabilities

Re: CVE-2026-85491: Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone

CVE-2026-85491 affects Catalyst::Seal versions before 0.03 for Perl, allowing an attacker to disable authorization checks on a path or route subsequent requests past protection by exploiting dispatch logic that relies only on the request path. The vulnerability poster clarified that repository metadata for the module contained errors.

Why it matters: Perl developers using Catalyst::Seal versions prior to 0.03 should upgrade immediately to prevent authorization bypass attacks that could allow unauthorized access to protected routes.

Source published

2026-09-24 22:58 UTC

First seen by Cybersecurity Tracker

2026-09-25 00:05 UTC