Reverse::Proxy versions prior to 0.04 for Perl improperly handle percent-decoded PATH_INFO by writing it unencoded into the upstream request line. Since PSGI decodes %XX sequences before the proxy processes them, the proxy appends raw bytes to the upstream URL without re-encoding. This allows an attacker to include CRLF (%0d%0a) sequences in the path, which terminate the request line early and cause the upstream server to treat subsequent data as a separate HTTP request. The proxy reuses keep-alive connections for multiple clients, so the attacker-controlled second request is attributed to the proxy and can reach upstream paths not exposed by the proxy's routing logic.

An attacker can perform HTTP request smuggling to send arbitrary second requests to the upstream server through the proxy. This can lead to unauthorized access to internal paths or services that the proxy does not expose, potentially bypassing security controls. The proxy's reuse of keep-alive connections exacerbates the risk by allowing the attacker to piggyback requests on existing connections.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting the use of Reverse::Proxy in environments where untrusted clients can send crafted HTTP requests. Monitoring for unusual upstream requests may help detect exploitation attempts.