Plack::Middleware::Security::Common versions prior to 0.13.1 fail to properly filter special elements in request paths, specifically CRLF sequences that enable header injection attacks. The header injection rule is ineffective unless the injection is double-encoded, allowing attackers to insert malicious headers into HTTP requests. This vulnerability is categorized under CWE-790 (Improper Filtering of Special Elements) and CWE-113 (Improper Neutralization of CRLF Sequences). The exact behavior of downstream components like reverse proxies or Plack servers when processing such injected headers is not clearly defined, which may affect the exploitability and impact.

The vulnerability allows an attacker to perform HTTP header injection via request paths, potentially leading to response splitting or manipulation of HTTP headers. This can result in information disclosure, cache poisoning, or other injection-based attacks depending on how the injected headers are handled by servers or proxies. The CVSS score of 7.3 reflects a high severity with network attack vector, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. However, the actual impact depends on the environment and how intermediaries process the injected headers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is documented, users should monitor vendor communications for updates. In the meantime, consider implementing additional input validation or filtering at the application or proxy level to detect and block CRLF injection attempts in request paths.