CVE-2026-78189

WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback. When a request matches no file, the PSGI handler retries it as an API route through apifilename. That keeps .. segments in the request path and only...

CVE-2026-78189 WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback

WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback. When a request matches no file, the PSGI handler retries it as an API route through apifilename. That keeps .. segments in the request path and only...

CVE-2026-78189

WebDyne versions from 3.007 before 3.022 are vulnerable to a path traversal vulnerability in the PSGI API route fallback . When a request matches no file, the PSGI handler retries it as an API route via api_filename, which preserves .. segments in the request path. Because the system only verifie...

EUVD-2026-114715

WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback. When a request matches no file, the PSGI handler retries it as an API route through apifilename. That keeps .. segments in the request path and only...

CVE-2026-78189 WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback

WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback. When a request matches no file, the PSGI handler retries it as an API route through apifilename. That keeps .. segments in the request path and only...

CVE-2026-78189: Path Traversal

WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback. When a request matches no file, the PSGI handler retries it as an API route through apifilename. That keeps .. segments in the request path and only...

PT-2026-134511

Name of the Vulnerable Software and Affected Versions WebDyne versions 3.007 through 3.021 Description Path traversal in the PSGI API route fallback allows the execution of Perl code within .psp files located outside the document root. This occurs because the PSGI handler retries requests that...

CVE-2026-118993

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The beforedispatch hook installed by startup removes PATHINFO from the end of the request URI with a substitution that interpolates PATHINFO...

CVE-2026-118993

Versions of CallBackery for Perl before 0.62.0 are vulnerable to a Denial of Service (DoS) attack. The issue resides in the before_dispatch hook, which removes PATH_INFO from the request URI using a substitution that interpolates PATH_INFO unquoted. In CGI, FastCGI, and PSGI environments, an unau...

CVE-2026-118993 CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The beforedispatch hook installed by startup removes PATHINFO from the end of the request URI with a substitution that interpolates PATHINFO...

EUVD-2026-113917

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The beforedispatch hook installed by startup removes PATHINFO from the end of the request URI with a substitution that interpolates PATHINFO...

CVE-2026-118993: Inefficient Regular Expression Complexity (ReDoS)

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The beforedispatch hook installed by startup removes PATHINFO from the end of the request URI with a substitution that interpolates PATHINFO...

PT-2026-133534

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The before dispatch hook installed by startup removes PATH INFO from the end of the request URI with a substitution that interpolates PATH INF...

FreeBSD : p5-Plack -- memory allocation vulnerability (3bd1edbf-d2d4-11f1-97dc-40b034429ecf)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 3bd1edbf-d2d4-11f1-97dc-40b034429ecf advisory. Plack project reports: Fix HTTP::Server::PSGI allocating a buffer as large as the declared...

CVE-2026-115825

A flaw was found in perl-Plack. The HTTP::Server::PSGI server pre-allocates memory for incoming request bodies based entirely on the declared Content-Length header before reading data. A remote attacker can exploit this flaw by sending an HTTP request with an excessively large Content-Length...

SUSE CVE-2026-115825

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the...

Linux Distros Unpatched Vulnerability : CVE-2026-115825

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with...

CVE-2026-115825

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the...

DEBIAN-CVE-2026-115825

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the...

CVE-2026-115825

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the...