CVE-2026-104380

MediumCVSS 5.3

Published: 06/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

In Punk versions from 0.48 before 0.55 for Perl, Extended CONNECT requests are routed to any GET route without an Origin check in ps_serve_one. On HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET and so reaches every GET route, API operation and mount. The Origin check runs only when a websocket route matches. On this transport the handler's status is the handshake response, and a 2xx accepts it. A cross-origin page can open a WebSocket to any path and learn from its open or error event whether that path returns 2xx.

Risk Assessment

The risk includes the possibility of cross-origin attacks that can reveal information about route availability and responses, potentially leading to confidentiality breaches.

Recommendation

Upgrade Punk to version 0.55 or later. Implement proper Origin checks for all routes and monitor WebSocket traffic.

Other vulnerabilities in Punk

CVE-2026-75870Critical
In the Punk library for Perl before version 0.18, there is a session cookie forgery vulnerability. When a session is declared without a secret, the default HMAC key is empty, allowing an attacker to mint cookies with arbitrary contents such as user ID or role.

Original NVD description (English source)

Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one. On HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET and so reaches every GET route, API operation and mount. The Origin check runs only when a websocket route matches. On this transport the handler's status is the handshake response, and a 2xx accepts it. A cross-origin page can open a WebSocket to any path and learn from its open or error event whether that path returns 2xx.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS