The vulnerability CVE-2026-9658 affects Plack::Middleware::Security::Common versions prior to 0.13.1. The middleware's header injection rule does not effectively block header injections in request paths unless the injection is double-encoded. Specifically, CRLF sequences in request paths can be used to inject additional HTTP headers, but the exact impact depends on how downstream components like reverse proxies or Plack servers handle these malformed requests. This issue is classified under CWE-790 (Improper Filtering of Special Elements) and CWE-113 (Improper Neutralization of CRLF Sequences). No CVSS score or patch information is currently available.

The vulnerability allows potential header injection via specially crafted request paths containing CRLF sequences. This could lead to HTTP response splitting or other injection-based attacks depending on how the server or intermediaries process the injected headers. The actual impact is uncertain due to unclear behavior of reverse proxies and Plack-based servers in handling such requests. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider additional protections at the reverse proxy or web server level to mitigate header injection risks. Monitoring for unusual request patterns involving CRLF sequences may also help detect attempts to exploit this vulnerability.