Missing WebSocket Origin check in Punk for Perl
Punk for Perl versions 0.48 before 0.55 routes HTTP/2 and HTTP/3 Extended CONNECT requests to any GET route, API operation, or mount without an Origin check in ps_serve_one. On those transports a WebSocket handshake arrives as an Extended CONNECT, is matched as a GET, and the Origin check runs only when a dedicated websocket route matches. The handler status is the handshake response, and a 2xx status accepts the socket, so a cross-origin page can open a WebSocket to any path and learn from the open or error event whether that path returns 2xx. Sites running an affected Punk version and serving HTTP/2 or HTTP/3 are affected. No public proof of concept is known, and the issue is not listed in CISA KEV.
What to do: Upgrade Punk for Perl to 0.55 or later. Until then, do not expose affected servers on HTTP/2 or HTTP/3, or disable Extended CONNECT and WebSocket handling if it is not required, and treat GET-route 2xx status as visible to cross-origin pages.
| Product | Affected |
|---|---|
| Punk for Perl | 0.48 before 0.55 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one. On HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET and so reaches every GET route, API operation and mount. The Origin check runs only when a websocket route matches. On this transport the handler's status is the handshake response, and a 2xx accepts it. A cross-origin page can open a WebSocket to any path and learn from its open or error event whether that path returns 2xx.
CVE-2026-104380 lets Punk 0.48–0.54 route Extended CONNECT requests to GET routes without an Origin check.
Today 1.6K readers · 2.5K views · 779 reads · all time 189K views