CVE-2026-104380
Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: CPANSec

Description
Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one. On HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET and so reaches every GET route, API operation and mount. The Origin check runs only when a websocket route matches. On this transport the handler's status is the handshake response, and a 2xx accepts it. A cross-origin page can open a WebSocket to any path and learn from its open or error event whether that path returns 2xx.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-19
AI Q&A
2026-10-06
EPSS Evaluated
2026-10-18
NVD
CVE-2026-104380
EUVD
EUVD-2026-92915

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1385 The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Punk web server versions from 0.48 before 0.55 for Perl. It involves Extended CONNECT requests being incorrectly routed to GET routes without proper Origin checks. On HTTP/2 and HTTP/3, WebSocket handshakes are treated as Extended CONNECT requests and matched to GET routes, bypassing Origin validation unless explicitly handled by a websocket route.

Detection Guidance

To detect this vulnerability, check if your system is running Punk versions between 0.48 and 0.54 for Perl. Verify if Extended CONNECT requests on HTTP/2 or HTTP/3 are incorrectly routed to GET routes without Origin validation. Inspect WebSocket handshake responses for 2xx status codes indicating potential exposure.

Impact Analysis

An attacker could exploit this to open a WebSocket connection to any path on your server from a cross-origin page. They can then determine if the path returns a 2xx status code by observing the WebSocket open or error event, potentially exposing sensitive information about your server's routes or API endpoints.

Compliance Impact

This vulnerability could potentially violate GDPR and HIPAA by enabling unauthorized cross-origin access to sensitive paths through WebSocket handshakes. It allows information leakage about valid endpoints, which may expose protected data or operations without proper authentication or authorization checks.

Mitigation Strategies

Upgrade Punk to version 0.55 or later to address the vulnerability in Extended CONNECT request handling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104380. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart