{"id":"CVE-2026-104380","title":"Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one.\n\nOn HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET …","summary":"Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one.\n\nOn HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET …","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-1385"],"product":"Punk","affected":["Punk >= 0.48 < 0.55"],"published":"2026-10-06","updated":"2026-10-06","sourceUpdated":"2026-10-06T15:03:59.427","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104380","references":[{"url":"https://metacpan.org/release/LNATION/Punk-0.55/changes","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/LNATION/Punk-0.55/diff/LNATION/Punk-0.54","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/06/1","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-06T13:14:06.093601Z"},"ingestedAt":"2026-10-06T01:38:44.801Z","epss":0.00163,"epssPercentile":0.05412,"slug":"CVE-2026-104380","body":"## Overview\n\nPunk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one.\n\nOn HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET and so reaches every GET route, API operation and mount. The Origin check runs only when a websocket route matches. On this transport the handler's status is the handshake response, and a 2xx accepts it.\n\nA cross-origin page can open a WebSocket to any path and learn from its open or error event whether that path returns 2xx.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":216456,"id":"CVE-2026-104380","ts":1791295293728,"field":"cvss","old":null,"new":"5.3"},{"seq":216455,"id":"CVE-2026-104380","ts":1791295293728,"field":"severity","old":"none","new":"medium"}]}