{"schema":"threatline.record/2","record":{"id":"CVE-2026-104380","aliases":[],"summary":"Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one","details":"Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one.\n\nOn HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET and so reaches every GET route, API operation and mount. The Origin check runs only when a websocket route matches. On this transport the handler's status is the handshake response, and a 2xx accepts it.\n\nA cross-origin page can open a WebSocket to any path and learn from its open or error event whether that path returns 2xx.","categories":["Libraries & packages"],"product":"","vendor":"","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104380","source_modified_at":"2026-10-06T13:14:39.875Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":null,"vendor":null,"versions":[{"lessThan":"0.55","status":"affected","version":"0.48","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104380","source_modified_at":"2026-10-06T13:14:39.875Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":null,"ecosystem":null},"version":"0.55","basis":"first unaffected version stated in the CVE record"}],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00163,"percentile":0.05183,"score_date":"2026-10-23"},"published_at":"2026-10-06T01:13:14.558Z","modified_at":"2026-10-06T13:14:39.875Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-104380","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-06T13:14:39.875Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104380","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://metacpan.org/release/LNATION/Punk-0.55/diff/LNATION/Punk-0.54","tags":["patch"]},{"source":"CVE List","url":"https://metacpan.org/release/LNATION/Punk-0.55/changes","tags":["release-notes"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CISA ADP","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-06T13:14:06.093601Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"summary-specific-product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-06T13:14:39.875Z","content_hash":"44831e5f5012547263a41ba4d75abfc35e08b9ffb182c042cdfb1d19439bc3b5"}}