The call method sets the policy in a response header named "content-security-protocol" instead of "Content-Security-Policy". Browsers ignore that header.
Any cross-site scripting flaw in the wrapped application can run scripts the policy was meant to block.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to Plack-Middleware-CSP 0.03 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 10 Nov 2026 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it. The call method sets the policy in a response header named "content-security-protocol" instead of "Content-Security-Policy". Browsers ignore that header. Any cross-site scripting flaw in the wrapped application can run scripts the policy was meant to block. | |
| Title | Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it | |
| Weaknesses | CWE-684 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-11-10T17:35:57.712Z
Reserved: 2026-11-10T11:17:20.551Z
Link: CVE-2026-125729
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-10T18:17:35.360
Modified: 2026-11-10T18:17:35.360
Link: CVE-2026-125729
Redhat
No data.
OpenCVE Enrichment
No data.