CVE-2026-104380: Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one

As cited

Copy frozen at 2026-10-06 08:20 UTC (site build).

vulnerabilities

CVE-2026-104380: Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one

Punk, a Perl module, has a vulnerability in versions 0.48 through 0.54 that routes Extended CONNECT requests to GET routes without verifying the Origin header. An attacker could exploit this to bypass security controls in the ps_serve_one function.

Why it matters: Perl developers using Punk versions 0.48 to 0.54 should upgrade to 0.55 or later to prevent cross-origin request forgery attacks that could compromise web application routing security.

Source published

2026-10-06 03:27 UTC

First seen by Cybersecurity Tracker

2026-10-06 06:05 UTC