CVE-2026-125729: Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it

Q: Who is exposed to this issue?

Applications using Plack::Middleware::CSP before version 0.03 are affected if they rely on the middleware to deliver a Content Security Policy. The practical impact requires a cross-site scripting flaw in the wrapped application, because the intended policy is not enforced by browsers.

Q: What should be done to remediate it?

Upgrade Plack::Middleware::CSP to version 0.03 or later. That release corrects the response header name so browsers can recognize and enforce the policy.

Q: How can I determine whether my application is affected?

Check the installed Plack::Middleware::CSP version and inspect an HTTP response from an application using the middleware. Affected versions send the policy in a header named "content-security-protocol" rather than "Content-Security-Policy".

Published Nov 10, 2026

Updated

Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it.

The call method sets the policy in a response header named "content-security-protocol" instead of "Content-Security-Policy". Browsers ignore that header.

Any cross-site scripting flaw in the wrapped application can run scripts the policy was meant to block.

Affected Software

1 affected component

cpan/Plack::Middleware::CSP<0.03

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Plack-Middleware-CSP to a version that resolves this vulnerability.
Fixed in 0.03

Event History

Nov 10, 2026

CVE Published

via MITRE·05:35 PM

Data Sourced

via MITRE·05:35 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·06:17 PM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications using Plack::Middleware::CSP before version 0.03 are affected if they rely on the middleware to deliver a Content Security Policy. The practical impact requires a cross-site scripting flaw in the wrapped application, because the intended policy is not enforced by browsers.

What should be done to remediate it?

Upgrade Plack::Middleware::CSP to version 0.03 or later. That release corrects the response header name so browsers can recognize and enforce the policy.

How can I determine whether my application is affected?

Check the installed Plack::Middleware::CSP version and inspect an HTTP response from an application using the middleware. Affected versions send the policy in a header named "content-security-protocol" rather than "Content-Security-Policy".

CVE-2026-125729: Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What should be done to remediate it?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What should be done to remediate it?

How can I determine whether my application is affected?