CVE-2026-17552
This vulnerability allows attackers to trick the web application into sending requests to arbitrary hosts by manipulating the request URI. By doing so, an attacker can cause the server to fetch content from internal or restricted systems. The flaw is present in older versions of Plack::App::Prerender before 0.3.0.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Plack::App::Prerender for Perl, versions before 0.3.0.
Real-world impact
An attacker can access internal or restricted hosts that only the webserver can reach, potentially exfiltrating sensitive data or enabling further attacks.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability is exploitable over the network with no authentication or user interaction, and can lead to confidentiality compromise.
What to do about it
- 01Upgrade to Plack::App::Prerender version 0.3.0 or later.
- 02Restart the web service to apply the update.
NVD description indicates versions 0.3.0 or later are not vulnerable.
Timeline
- Jul 27, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 28, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.