CVE-2026-104380: Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one
AI summary · grok-4.7Summaries by Vani AI
CVE-2026-104380 lets Punk 0.48–0.54 route Extended CONNECT requests to GET routes without an Origin check.
Timothy Legge reported CVE-2026-104380 on the oss-security list. Punk for Perl, versions from 0.48 before 0.55, routes Extended CONNECT requests to any GET route. The issue is in ps_serve_one, which skips an Origin check. The post does not report in-the-wild exploitation.
Key facts
- CVE-2026-104380 affects Punk 0.48 before 0.55.
- Extended CONNECT requests are routed to any GET route.
- ps_serve_one does not perform an Origin check.
- Mailing-list disclosure only; no exploitation reported.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-104380 | Missing WebSocket Origin check in Punk for Perl | 5.3 | — |
From the original article
Posted by Timothy Legge on Oct 05 ======================================================================== https://metacpan. org/dist/Punk Punk versions from 0. 48 before 0.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.