CVE-2026-75922

Name of the Vulnerable Software and Affected Versions Reverse::Proxy versions prior to 0.04

Description Reverse::Proxy for Perl allows HTTP request smuggling because it writes a percent-decoded PATH INFO unencoded to the upstream request line. PSGI provides PATH INFO to the application already percent-decoded, meaning %XX sequences in the client URL are converted to raw bytes. The proxy appends this byte string to the upstream base URL and, during an Upgrade tunnel, serializes the request line without re-encoding. If a path contains %0d%0a, it is processed as a CRLF (Carriage Return Line Feed), which terminates the request line. Similarly, a decoded space, ?, or # can truncate the line. Consequently, any data sent by the client after the CRLF is interpreted by the upstream server as a second, separate request. When using a buffered path on a pooled keep-alive connection, the client can specify the method, path, and headers, allowing them to access upstream paths that the proxy's routing normally restricts.

Recommendations Update to version 0.04 or later.