CVE-2026-75922: CWE-444 Inconsistent Interpretation of HTTP Requests

Reverse::Proxy versions prior to 0.04 for Perl improperly handle percent-decoded PATH_INFO by writing it unencoded to the upstream request line. Since PSGI passes PATH_INFO percent-decoded, any %XX sequences become raw bytes before the proxy processes them. The proxy appends this byte string directly to the upstream URL without re-encoding. An attacker can include %0d%0a (CRLF) sequences in the path, which the upstream server interprets as the end of the request line, causing it to treat subsequent data as a separate HTTP request. This allows HTTP request smuggling, where attacker-controlled requests are sent on a keep-alive connection pooled by the proxy, potentially reaching upstream paths not exposed by the proxy's routing logic.

An attacker can smuggle additional HTTP requests to the upstream server by injecting CRLF sequences in the URL path. These requests are attributed to the proxy and can bypass the proxy's routing controls, potentially accessing restricted upstream resources. The vulnerability has a CVSS score of 5.3 (medium severity) with low complexity and no required privileges or user interaction. There is no indication of confidentiality, integrity, or availability impact beyond the ability to send unauthorized requests upstream.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using vulnerable versions of Reverse::Proxy or implement upstream protections to detect and block request smuggling attempts. Do not rely on the proxy's routing for security enforcement in affected versions.