CVE-2026-95811
Received Received - Intake

Path Normalization Bypass in Lemonldap::NG::Handler

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: CPANSec

Description
Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it. The handler matches each vhost's locationRules regular expressions against REQUEST_URI, the raw request line, while the web server routes on the path it has already percent-decoded and normalized. A request that percent-encodes a character of the path, inserts dot segments, or doubles a slash therefore reaches the protected resource under a URI that no rule regexp matches, and the vhost's default rule decides access. Deny rules, identity and group conditions, and unprotect and skip rules are bypassed alike. Only a vhost whose default rule is more permissive than its other rules is affected. An authenticated user then reaches any URL a locationRules regexp was meant to restrict, but gains no more than that default rule already grants.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-95811
EUVD
EUVD-2026-86497

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
lemonldap ng_handler From 2.0.0 (inc) to 2.16.10 (exc)
lemonldap ng_handler From 2.17.0 (inc) to 2.21.6 (exc)
lemonldap ng_handler From 2.22.0 (inc) to 2.23.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-180 The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Lemonldap::NG::Handler versions before 2.16.10, 2.21.6, and 2.23.4. It allows bypassing locationRules that restrict access to certain paths by using percent-encoded characters, dot segments, or double slashes in the request URI. The handler checks rules against the raw request line while the web server uses a normalized path, creating a mismatch that lets requests reach restricted resources.

Detection Guidance

Check LemonLDAP::NG Handler versions with commands like 'dpkg -l | grep lemonldap' or 'rpm -qa | grep lemonldap'. Inspect web server logs for unusual percent-encoded paths, dot segments, or double slashes in REQUEST_URI. Test with crafted URLs containing %2e, %2f, or // to see if access bypasses locationRules.

Impact Analysis

An authenticated user could access URLs that were meant to be restricted by locationRules. However, the impact is limited to what the default rule already allows. The vulnerability does not grant additional privileges beyond the default access level of the vhost.

Compliance Impact

This vulnerability allows bypassing access restrictions in Lemonldap::NG::Handler, potentially granting unauthorized access to protected resources. For compliance standards like GDPR or HIPAA, which require strict access controls and data protection, this could lead to unauthorized data exposure or breaches, violating regulatory requirements for data security and access management.

Mitigation Strategies

Upgrade LemonLDAP::NG Handler to versions 2.16.10, 2.21.6, or 2.23.4 or later. Review and tighten default rules in locationRules to ensure they are not more permissive than intended. Monitor logs for bypass attempts and adjust regex patterns to account for percent-encoded paths and path normalization.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95811. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart