Plack::Middleware::CSP before 0.03 sends CSP under the wrong header
Browsers never enforce the policy, so Perl apps using the middleware get no Content-Security-Policy protection.
42
CVE-2026-125729
Wrong CSP header in Plack::Middleware::CSP before 0.03
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Plack::Middleware::CSP before 0.03 for Perl writes the Content Security Policy to a response header named content-security-protocol instead of Content-Security-Policy. Browsers ignore the misspelled header, so the policy is never enforced. Anyone who can trigger cross-site scripting in the wrapped application can run scripts the policy was meant to block. Sites that rely on this middleware for CSP are affected.
What to do: Upgrade Plack::Middleware::CSP to 0.03 or later so the policy is sent as Content-Security-Policy.
| Product | Affected | Fixed in |
|---|---|---|
| Plack::Middleware::CSP | before 0.03 | 0.03 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it. The call method sets the policy in a response header named "content-security-protocol" instead of "Content-Security-Policy". Browsers ignore that header. Any cross-site scripting flaw in the wrapped application can run scripts the policy was meant to block.
- Weakness
- CWE-684