CVE-2026-9658 Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths

[
  {
    "collectionURL": "https://cpan.org/modules",
    "defaultStatus": "unaffected",
    "packageName": "Plack-Middleware-Security-Simple",
    "product": "Plack::Middleware::Security::Common",
    "programFiles": [
      "lib/Plack/Middleware/Security/Common.pm"
    ],
    "programRoutines": [
      {
        "name": "Plack::Middleware::Security::Common::header_injection"
      }
    ],
    "repo": "https://github.com/robrwo/Plack-Middleware-Security-Simple",
    "vendor": "RRWO",
    "versions": [
      {
        "lessThan": "0.13.1",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]