Search
Find a vulnerability
Search criteria
2 vulnerabilities found for gazelle by kazeburo
CVE-2026-40562 (GCVE-0-2026-40562)
Vulnerability from nvd – Published: 2026-05-06 12:36 – Updated: 2026-05-07 16:13
VLAI
Title
Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header Precedence
Summary
Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header Precedence.
Gazelle incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.
An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
References
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-40562",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-06T14:14:25.637199Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-06T14:15:32.815Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-05-06T16:32:45.619Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/05/06/7"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"packageName": "Gazelle",
"product": "Gazelle",
"programFiles": [
"lib/Plack/Handler/Gazelle.pm",
"lib/Plack/Handler/Gazelle.xs"
],
"programRoutines": [
{
"name": "Plack::Handler::Gazelle::run"
},
{
"name": "lib/Plack/Handler/Gazelle.xs::_parse_http_request"
}
],
"repo": "https://github.com/kazeburo/Gazelle",
"vendor": "KAZEBURO",
"versions": [
{
"lessThanOrEqual": "0.49",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "CPANSec"
}
],
"descriptions": [
{
"lang": "en",
"value": "Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header Precedence.\n\nGazelle incorrectly prioritizes \"Content-Length\" over \"Transfer-Encoding: chunked\" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.\n\nAn attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy."
}
],
"impacts": [
{
"capecId": "CAPEC-33",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-33 HTTP Request Smuggling"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-07T16:13:49.501Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"url": "https://datatracker.ietf.org/doc/html/rfc7230#section-3.3.3"
},
{
"tags": [
"patch"
],
"url": "https://security.metacpan.org/patches/G/Gazelle/0.49/CVE-2026-40562-r1.patch"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/KAZEBURO/Gazelle-0.50/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Gazelle 0.50 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2026-04-12T00:00:00.000Z",
"value": "Issue identified by CPANSec"
},
{
"lang": "en",
"time": "2026-04-29T00:00:00.000Z",
"value": "Issue reported to software maintainer"
},
{
"lang": "en",
"time": "2026-05-06T00:00:00.000Z",
"value": "Issue disclosed by CPANSec"
},
{
"lang": "en",
"time": "2026-05-07T00:00:00.000Z",
"value": "Gazelle 0.50 released"
}
],
"title": "Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header Precedence",
"workarounds": [
{
"lang": "en",
"value": "Migrate to Starman version 0.4018 or newer which has fixed the issue. Or apply the patch."
}
],
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-40562",
"datePublished": "2026-05-06T12:36:34.715Z",
"dateReserved": "2026-04-14T11:35:53.644Z",
"dateUpdated": "2026-05-07T16:13:49.501Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40562 (GCVE-0-2026-40562)
Vulnerability from cvelistv5 – Published: 2026-05-06 12:36 – Updated: 2026-05-07 16:13
VLAI
Title
Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header Precedence
Summary
Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header Precedence.
Gazelle incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.
An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
References
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-40562",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-06T14:14:25.637199Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-06T14:15:32.815Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-05-06T16:32:45.619Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/05/06/7"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"packageName": "Gazelle",
"product": "Gazelle",
"programFiles": [
"lib/Plack/Handler/Gazelle.pm",
"lib/Plack/Handler/Gazelle.xs"
],
"programRoutines": [
{
"name": "Plack::Handler::Gazelle::run"
},
{
"name": "lib/Plack/Handler/Gazelle.xs::_parse_http_request"
}
],
"repo": "https://github.com/kazeburo/Gazelle",
"vendor": "KAZEBURO",
"versions": [
{
"lessThanOrEqual": "0.49",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "CPANSec"
}
],
"descriptions": [
{
"lang": "en",
"value": "Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header Precedence.\n\nGazelle incorrectly prioritizes \"Content-Length\" over \"Transfer-Encoding: chunked\" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.\n\nAn attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy."
}
],
"impacts": [
{
"capecId": "CAPEC-33",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-33 HTTP Request Smuggling"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-07T16:13:49.501Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"url": "https://datatracker.ietf.org/doc/html/rfc7230#section-3.3.3"
},
{
"tags": [
"patch"
],
"url": "https://security.metacpan.org/patches/G/Gazelle/0.49/CVE-2026-40562-r1.patch"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/KAZEBURO/Gazelle-0.50/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Gazelle 0.50 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2026-04-12T00:00:00.000Z",
"value": "Issue identified by CPANSec"
},
{
"lang": "en",
"time": "2026-04-29T00:00:00.000Z",
"value": "Issue reported to software maintainer"
},
{
"lang": "en",
"time": "2026-05-06T00:00:00.000Z",
"value": "Issue disclosed by CPANSec"
},
{
"lang": "en",
"time": "2026-05-07T00:00:00.000Z",
"value": "Gazelle 0.50 released"
}
],
"title": "Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header Precedence",
"workarounds": [
{
"lang": "en",
"value": "Migrate to Starman version 0.4018 or newer which has fixed the issue. Or apply the patch."
}
],
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-40562",
"datePublished": "2026-05-06T12:36:34.715Z",
"dateReserved": "2026-04-14T11:35:53.644Z",
"dateUpdated": "2026-05-07T16:13:49.501Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}