Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-85491— Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone

Quick assessment

Affected
CVE-2026-85491
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述信息的中文翻译： --- 在 Perl 的 Catalyst::Seal 模块版本低于 0.03 的版本中，攻击者可以通过一次请求来禁用某个路径或路由，从而使得后续请求绕过授权检查。这是因为该模块使用了仅基于请求路径作为键的调度备忘录（dispatch memo）。 Catalyst::Seal 通过替换调度器中的 方法，实现了一种对路径解析结果进行记忆化的机制：它会记录某个路径匹配到了哪种调度类型、在哪个层级上匹配成功，以及剩余哪些参数作为后续处理的依据。然而，该记忆化机制所使用的键只是请求路径，

AI Predicted 7.5 Difficulty: Moderate EPSS 0.36% · P27

I. Basic Information for CVE-2026-85491

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone
Source: CVE Program / CVE List V5
Vulnerability Description
Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone. Catalyst::Seal replaces the dispatcher's prepare_action with a version that memoises how a path resolved: which dispatch type matched, at which level, and what was left over as arguments. The key is the request path and nothing else. Action roles that match on the method, content type, scheme or query make that resolution depend on state the key does not carry, so the memo answers for a request it was not built from. A path that resolves to no action is memoised as well, and replaying that entry returns without consulting any dispatch type, so no action is set and the request fails. A GET of a path whose action is declared POST-only therefore disables that path for every later request, the correct POST included. An entry that did resolve replays the level the earlier descent reached. Where a POST-only action sits below a shallower action on the same path, a GET memoises the shallow route, and a later POST is dispatched there with an auto() guarding the deeper controller never running. The memo is cleared only when an action is registered, which happens at setup, so an entry lasts for the life of the process, and its cap of 2048 entries bounds how many paths one caller can disable. In the configuration measured, the misroute lands on the less privileged action, so it is an authorization check not running rather than a privilege gain.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
缺失要素致使对比不完全
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 0.03 -

II. Public POCs for CVE-2026-85491

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-85491

请登录查看更多情报信息。

Other References for CVE-2026-85491 (2)

IV. Related Vulnerabilities

Same weakness: CWE-1023

V. Comments for CVE-2026-85491

No comments yet

Leave a comment