CVE-2026-95811: Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it
Lemonldap::NG::Handler lets equivalent path spellings bypass locationRules before fixed releases (CVE-2026-95811).
The CPAN Security Group disclosed CVE-2026-95811 in Lemonldap::NG::Handler for Perl. Affected versions are 2.0.0 before 2.16.10, 2.17.0 before 2.21.6, and 2.22.0 before 2.23.4. An equivalent spelling of a path can bypass locationRules that are meant to restrict it. The oss-security post does not report in-the-wild exploitation.
- CVE-2026-95811 affects Lemonldap::NG::Handler for Perl.
- Equivalent path spellings can bypass locationRules restrictions.
- Vulnerable ranges end before 2.16.10, 2.21.6, and 2.23.4.
- The disclosure does not report active exploitation.
- CVEs
- CVE-2026-95811
- Products
- Lemonldap::NG::Handler
- Organizations
- CPAN Security Group
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-95811 | Authorization bypass via URI normalization mismatch in Lemonldap::NG Handler | 6.5 | — |
From the original article
Posted by Timothy Legge on Sep 24 ======================================================================== CVE-2026-95811 CPAN Security Group ======================================================================== CVE ID: CVE-2026-95811 Distribution: Lemonldap-NG-Handler Versions: from 2. 0. 0 before 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.