Plack::Middleware::CSP before 0.03 sends CSP under the wrong header
Original title: CVE-2026-125729: Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it
Browsers never enforce the policy, so Perl apps using the middleware get no Content-Security-Policy protection.
Robert Rothenberg reported that Plack::Middleware::CSP versions before 0.03 send the Content Security Policy under the wrong header name. Browsers therefore never enforce it. The notice points to the MetaCPAN distribution; the excerpt does not describe exploitation or a patch release.
Unconfirmed: The excerpt does not state a fixed release or whether the flaw has been exploited.
- The issue is tracked as CVE-2026-125729.
- Affected releases are versions before 0.03.
- The report was posted to oss-security on November 10.
Impact: Browsers never enforce the Content Security Policy
| Product | Affected |
|---|---|
| Plack::Middleware::CSP | before 0.03 |
- 1.Move off Plack::Middleware::CSP versions before 0.03.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-125729 | Wrong CSP header in Plack::Middleware::CSP before 0.03 | — | — |
From the original article
Posted by Robert Rothenberg on Nov 10 ======================================================================== https://metacpan. org/dist/Plack-Middleware-CSP VCS Repo: ...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.