CVE-2026-75922: Reverse::Proxy Path Traversal Vulnerability

CVE-2026-75922 Overview

CVE-2026-75922 is an HTTP request smuggling vulnerability in the Perl Reverse::Proxy module versions before 0.04. The proxy writes a percent-decoded PATH_INFO value directly into the upstream request line without re-encoding CRLF or other control characters. An attacker who sends a URL containing %0d%0a can terminate the upstream request line and inject a second, attacker-controlled request onto the pooled keep-alive connection. The smuggled request is attributed to the proxy and can reach upstream paths that the proxy's own routing does not expose. The issue is classified under CWE-93: Improper Neutralization of CRLF Sequences.

Critical Impact
Attackers can smuggle arbitrary HTTP requests through the reverse proxy to internal upstream endpoints, bypassing proxy-level access controls and potentially poisoning responses served to other pooled clients.

Affected Products

Perl Reverse::Proxy module versions prior to 0.04
Applications running on PSGI stacks that route requests through vulnerable Reverse::Proxy instances
Upstream services reachable via keep-alive connections pooled by the vulnerable proxy

Discovery Timeline

2026-08-23 - CVE-2026-75922 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75922

Vulnerability Analysis

The defect lives at the boundary between PSGI semantics and outbound HTTP serialization. PSGI hands PATH_INFO to the application already percent-decoded, so any %XX sequence submitted by the client is a raw byte inside the proxy. Reverse::Proxy appends that byte string to the upstream base URL and, for Upgrade tunnels, writes it into a request line it serializes itself. Neither the proxy nor the underlying HTTP client re-encodes reserved or control characters before transmission.

A client-supplied %0d%0a therefore reaches the upstream as a literal CRLF. That CRLF terminates the request line, and everything the proxy writes afterward is parsed by the upstream as a second HTTP request. A decoded space, ?, or # truncates the request line in the same fashion. On the buffered code path, the smuggled request rides a keep-alive connection the proxy pools and reuses, so a subsequent legitimate client can be paired with a poisoned response.

Root Cause

The root cause is missing output encoding on already-decoded input. Reverse::Proxy treats PATH_INFO as opaque and safe, but PSGI guarantees the value is decoded. The absence of a re-encoding step on the outbound request line lets CRLF and other reserved bytes cross an unintended trust boundary.

Attack Vector

An unauthenticated remote attacker sends an HTTP request whose path contains percent-encoded CRLF. The proxy decodes the sequence, forwards raw CRLF upstream, and the upstream parses the trailing bytes as a distinct request. Attackers control the smuggled method, path, and headers, and the upstream attributes the request to the proxy.

See the MetaCPAN source for Reverse-Proxy 0.03 and the fix in 0.04 for the specific serialization logic. The OpenWall disclosure documents the smuggling path.

Detection Methods for CVE-2026-75922

Indicators of Compromise

Upstream access logs showing requests with methods, paths, or Host headers that the reverse proxy does not normally emit.
Client requests containing %0d, %0a, %20, %23, or %3f in the URL path segment forwarded through Reverse::Proxy.
Response mismatches on pooled keep-alive connections, where clients receive content intended for a different request.

Detection Strategies

Inspect proxy and upstream logs for divergence in request counts across a shared keep-alive connection.
Alert on HTTP requests whose decoded PATH_INFO contains CR (\r), LF (\n), or embedded whitespace before forwarding.
Correlate upstream requests that lack the proxy's standard forwarded headers (for example X-Forwarded-For) despite arriving on a proxy connection.

Monitoring Recommendations

Enable verbose request logging on upstream services to capture raw request lines for forensic review.
Deploy web application firewall rules that reject encoded CRLF in URL paths at the perimeter.
Monitor Perl CPAN dependency inventories for Reverse::Proxy versions below 0.04 in production PSGI deployments.

How to Mitigate CVE-2026-75922

Immediate Actions Required

Upgrade Reverse::Proxy to version 0.04 or later on all Perl PSGI hosts.
Audit upstream application logs for smuggled requests reaching non-exposed routes since the module was first deployed.
Disable HTTP keep-alive between the proxy and upstream services until patching completes, to limit request-pairing risk.

Patch Information

The maintainer released Reverse::Proxy0.04, which re-encodes reserved and control characters before writing them to the outbound request line. Refer to the MetaCPAN 0.04 change log for the full fix summary and the patched serialization code.

Workarounds

Front the vulnerable proxy with a hardened HTTP layer, such as nginx or HAProxy, that rejects CRLF and other control bytes in request paths.
Enforce strict input validation in the PSGI application to drop requests whose PATH_INFO contains \r, \n, or unexpected whitespace.
Restrict upstream services to accept connections only from trusted proxies and require an authentication token the smuggled request cannot forge.

bash

# Upgrade Reverse::Proxy via cpanm
cpanm Reverse::Proxy@0.04

# Verify installed version
perl -MReverse::Proxy -E 'say Reverse::Proxy->VERSION'