Plack Project
Products
6- 2 CVEs
- 1 CVE
- 1 CVE
- 1 CVE
- 0 CVEs
- 0 CVEs
Recent CVEs
5| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-12740 | Hig | 0.46 | 8.1 | 0.00 | Jul 4, 2026 | Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter. RequestTokenV2 builds the provider authorization redirect without issuing a state value, and AccessTokenV2 exchanges the callback code and registers the resulting token into… | ||
| CVE-2013-10031 | Hig | 0.42 | 7.5 | 0.00 | Dec 9, 2025 | Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks | ||
| CVE-2025-40923 | Hig | 0.40 | 7.3 | 0.00 | Jul 16, 2025 | Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time… | ||
| CVE-2026-45179 | Med | 0.27 | 5.3 | 0.00 | May 10, 2026 | Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses. If the communication channel to the statsd daemon is not secured (for example, by sending UDP packets to a host on another network), then users' IP addresses may be leaked. Since version… | ||
| CVE-2014-5269 | 0.00 | — | 0.02 | Sep 4, 2014 | Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static. |
- risk 0.46cvss 8.1epss 0.00
Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter. RequestTokenV2 builds the provider authorization redirect without issuing a state value, and AccessTokenV2 exchanges the callback code and registers the resulting token into…
- risk 0.42cvss 7.5epss 0.00
Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks
- risk 0.40cvss 7.3epss 0.00
Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time…
- risk 0.27cvss 5.3epss 0.00
Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses. If the communication channel to the statsd daemon is not secured (for example, by sending UDP packets to a host on another network), then users' IP addresses may be leaked. Since version…
- CVE-2014-5269Sep 4, 2014risk 0.00cvss —epss 0.02
Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static.