CVE-2026-75922: Inconsistent Interpretation of HTTP Requests

Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...

CVE-2026-66746

Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...