Hi,

The following vulnerabilities were published for libplack-perl.

The new 1.0055 releases fixes:

| SECURITY
|
|     Fix memory leak of every request env in Plack::Middleware::Recursive (CVE-2026-110333)
|     Plack::Request::Upload->basename never returns '', '.' or '..' (CVE-2026-110332)
|     Plack::App::URLMap matches SERVER_PORT literally when stripping it from Host (CVE-2026-110335)
|
| BUG FIXES
|
|     Plack::Middleware::ErrorDocument restores the env after a subrequest, so outer middleware such as AccessLog sees the original request (CVE-2026-110334)
|
| DOCUMENTATION
|
|     Document that Plack::Handler::FCGI and Apache2 keep dot segments in PATH_INFO and warn against relying on front-server path-based access control (CVE-2026-110336)

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-110333
https://www.cve.org/CVERecord?id=CVE-2026-110333
[1] https://security-tracker.debian.org/tracker/CVE-2026-110332
https://www.cve.org/CVERecord?id=CVE-2026-110332
[2] https://security-tracker.debian.org/tracker/CVE-2026-110335
https://www.cve.org/CVERecord?id=CVE-2026-110335
[3] https://security-tracker.debian.org/tracker/CVE-2026-110334
https://www.cve.org/CVERecord?id=CVE-2026-110334
[4] https://security-tracker.debian.org/tracker/CVE-2026-110336
https://www.cve.org/CVERecord?id=CVE-2026-110336

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
libplack-perl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1151241@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
gregor herrmann <gregoa@debian.org> (supplier of updated libplack-perl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 18 Oct 2026 23:40:30 +0200
Source: libplack-perl
Architecture: source
Version: 1.0055-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed-By: gregor herrmann <gregoa@debian.org>
Closes: 1151241
Changes:
 libplack-perl (1.0055-1) unstable; urgency=medium
 .
   * Import upstream version 1.0055.
     - Fix memory leak of every request env in Plack::Middleware::Recursive
       (CVE-2026-110333)
     - Plack::Request::Upload->basename never returns '', '.' or '..'
       (CVE-2026-110332)
     - Plack::App::URLMap matches SERVER_PORT literally when stripping it from
       Host (CVE-2026-110335)
     - Plack::Middleware::ErrorDocument restores the env after a subrequest, so
       outer middleware such as AccessLog sees the original request
       (CVE-2026-110334)
     - Document that Plack::Handler::FCGI and Apache2 keep dot segments in
       PATH_INFO and warn against relying on front-server path-based access
       control (CVE-2026-110336)
     Closes: #1151241
Checksums-Sha1:
 29c6f1fa7d4d33c7e3e8343e6d3baa235e2fc0d0 3450 libplack-perl_1.0055-1.dsc
 a78fe14ef258003dcda35777b47c24e00083d477 200769 libplack-perl_1.0055.orig.tar.gz
 04256405deb2c0375bdfb517856d1ac3b51aaadc 7096 libplack-perl_1.0055-1.debian.tar.xz
 b94657f2c442801b9ada335d52d3d3d60b84c4ba 384412 libplack-perl_1.0055-1.git.tar.xz
 64f905b3e62b51ee0ad8bb1c9ace46098dbb81b4 17752 libplack-perl_1.0055-1_source.buildinfo
Checksums-Sha256:
 31caab68c3c2fb06f687c1e98f1485b5b3939b177cfbc06292f9ccf7ce1eb492 3450 libplack-perl_1.0055-1.dsc
 f44918483e58af6aac547b51fce3eaa7fb089cdbef03a7968163df5a6414e5b0 200769 libplack-perl_1.0055.orig.tar.gz
 98f3d762b983d89ca1be6f40102ceab25f6f2e967825db2241d0f2873ebc8331 7096 libplack-perl_1.0055-1.debian.tar.xz
 9206ee6bb939679400caa422a835779a3f7fcde1ca4f8cd0d12ca218d304ce1d 384412 libplack-perl_1.0055-1.git.tar.xz
 eb354085be4c1187cfac4b9d5700907b5db49d1785b116dea2af6d3f5bc3de7e 17752 libplack-perl_1.0055-1_source.buildinfo
Files:
 d675352c96ea0097b9ba17d46d546adb 3450 perl optional libplack-perl_1.0055-1.dsc
 ba01d7c745d6eecb7c6776deacfa87f7 200769 perl optional libplack-perl_1.0055.orig.tar.gz
 36a81ae2ef62b56f00f0f2ac9c55a253 7096 perl optional libplack-perl_1.0055-1.debian.tar.xz
 5b21b2e17387fee673012a307ca62d32 384412 perl None libplack-perl_1.0055-1.git.tar.xz
 b6b9830abd6a830ef443042c9964f302 17752 perl optional libplack-perl_1.0055-1_source.buildinfo
Git-Tag-Info: tag=8541ba7c108c05ede9b50ad4d81a2420786b5885 fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <gregoa@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrVPnUACgkQYG0ITkaD
wHkK8Q/+NS5QrZ8aj2OHdHkNLiCW6plcXria9LL0p9OgFFal8o5i5WFT8vu7KX6p
l2RUBTco07bqhHl1uBASaWEJbzPtSK/x0xVzqBPSesiMJRBet9bqxy6fcfy0wiBR
Ouj9/ewFCf73IzjL+tRa0nSXu6Yv/siCZ1HKBgmc44eFng3WsPJeLCdiaRYrhT9b
dV1lsaEd5E92EwsZ6KHck5i6IEn+npho8XKzs/qVIu3IMO4jBqypJtDEvbQ6eds+
q1ZIRQ0661+RPuaE9TaR6T8fn7wd0WDWMVDkerzokGiRfFLR/30IYbt1FHx9vZCK
7IjyRQF46giUbOZOZMvdaWEv8YOjLBZZ1LA7TY97jSdnCOxZ+XNI00mP/W126PY3
ER7n8+mNBAGohaN+WgaeoqLGOv2XtcKYq1CirvqN0eGWFlDP4l45xZPIyeJYBU8+
kbSbG7I4fcvrSK0JA5GXYrjjpzNF8Bp6tTyft0zZPnBchBihorGj+IoXUONrU8+2
fVm7R98WCf6G+W+g3PYqZuKwW/NW7meclLBu8dyHT2MXEzybB1xplWP2+E/vuykW
Ih/LqJwm6dn/AEs3Z6dWTSUKKg7YDPsJj04y9Fwd14XHj0Gc6PSGSuEXmT0VwjnR
amdsWieyA0r6rCnoLQZqEiES/B+ObBe1/aL+/+i20s4vS6LGi8I=
=/8YJ
-----END PGP SIGNATURE-----