Source: libplack-perl Version: 1.0054-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerabilities were published for libplack-perl. The new 1.0055 releases fixes: | SECURITY | | Fix memory leak of every request env in Plack::Middleware::Recursive (CVE-2026-110333) | Plack::Request::Upload->basename never returns '', '.' or '..' (CVE-2026-110332) | Plack::App::URLMap matches SERVER_PORT literally when stripping it from Host (CVE-2026-110335) | | BUG FIXES | | Plack::Middleware::ErrorDocument restores the env after a subrequest, so outer middleware such as AccessLog sees the original request (CVE-2026-110334) | | DOCUMENTATION | | Document that Plack::Handler::FCGI and Apache2 keep dot segments in PATH_INFO and warn against relying on front-server path-based access control (CVE-2026-110336) If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-110333 https://www.cve.org/CVERecord?id=CVE-2026-110333 [1] https://security-tracker.debian.org/tracker/CVE-2026-110332 https://www.cve.org/CVERecord?id=CVE-2026-110332 [2] https://security-tracker.debian.org/tracker/CVE-2026-110335 https://www.cve.org/CVERecord?id=CVE-2026-110335 [3] https://security-tracker.debian.org/tracker/CVE-2026-110334 https://www.cve.org/CVERecord?id=CVE-2026-110334 [4] https://security-tracker.debian.org/tracker/CVE-2026-110336 https://www.cve.org/CVERecord?id=CVE-2026-110336 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
