CVE-2026-104380: Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one
CVE-2026-104380 lets Punk 0.48–0.54 route Extended CONNECT requests to GET routes without an Origin check.