-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 18 Oct 2026 23:40:30 +0200 Source: libplack-perl Architecture: source Version: 1.0055-1 Distribution: unstable Urgency: medium Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org> Changed-By: gregor herrmann <gregoa@debian.org> Closes: 1151241 Changes: libplack-perl (1.0055-1) unstable; urgency=medium . * Import upstream version 1.0055. - Fix memory leak of every request env in Plack::Middleware::Recursive (CVE-2026-110333) - Plack::Request::Upload->basename never returns '', '.' or '..' (CVE-2026-110332) - Plack::App::URLMap matches SERVER_PORT literally when stripping it from Host (CVE-2026-110335) - Plack::Middleware::ErrorDocument restores the env after a subrequest, so outer middleware such as AccessLog sees the original request (CVE-2026-110334) - Document that Plack::Handler::FCGI and Apache2 keep dot segments in PATH_INFO and warn against relying on front-server path-based access control (CVE-2026-110336) Closes: #1151241 Checksums-Sha1: 29c6f1fa7d4d33c7e3e8343e6d3baa235e2fc0d0 3450 libplack-perl_1.0055-1.dsc a78fe14ef258003dcda35777b47c24e00083d477 200769 libplack-perl_1.0055.orig.tar.gz 04256405deb2c0375bdfb517856d1ac3b51aaadc 7096 libplack-perl_1.0055-1.debian.tar.xz b94657f2c442801b9ada335d52d3d3d60b84c4ba 384412 libplack-perl_1.0055-1.git.tar.xz 64f905b3e62b51ee0ad8bb1c9ace46098dbb81b4 17752 libplack-perl_1.0055-1_source.buildinfo Checksums-Sha256: 31caab68c3c2fb06f687c1e98f1485b5b3939b177cfbc06292f9ccf7ce1eb492 3450 libplack-perl_1.0055-1.dsc f44918483e58af6aac547b51fce3eaa7fb089cdbef03a7968163df5a6414e5b0 200769 libplack-perl_1.0055.orig.tar.gz 98f3d762b983d89ca1be6f40102ceab25f6f2e967825db2241d0f2873ebc8331 7096 libplack-perl_1.0055-1.debian.tar.xz 9206ee6bb939679400caa422a835779a3f7fcde1ca4f8cd0d12ca218d304ce1d 384412 libplack-perl_1.0055-1.git.tar.xz eb354085be4c1187cfac4b9d5700907b5db49d1785b116dea2af6d3f5bc3de7e 17752 libplack-perl_1.0055-1_source.buildinfo Files: d675352c96ea0097b9ba17d46d546adb 3450 perl optional libplack-perl_1.0055-1.dsc ba01d7c745d6eecb7c6776deacfa87f7 200769 perl optional libplack-perl_1.0055.orig.tar.gz 36a81ae2ef62b56f00f0f2ac9c55a253 7096 perl optional libplack-perl_1.0055-1.debian.tar.xz 5b21b2e17387fee673012a307ca62d32 384412 perl None libplack-perl_1.0055-1.git.tar.xz b6b9830abd6a830ef443042c9964f302 17752 perl optional libplack-perl_1.0055-1_source.buildinfo Git-Tag-Info: tag=8541ba7c108c05ede9b50ad4d81a2420786b5885 fp=d1e1316e93a760a8104d85fabb3a68018649aa06 Git-Tag-Tagger: gregor herrmann <gregoa@debian.org> -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrVPnUACgkQYG0ITkaD wHkK8Q/+NS5QrZ8aj2OHdHkNLiCW6plcXria9LL0p9OgFFal8o5i5WFT8vu7KX6p l2RUBTco07bqhHl1uBASaWEJbzPtSK/x0xVzqBPSesiMJRBet9bqxy6fcfy0wiBR Ouj9/ewFCf73IzjL+tRa0nSXu6Yv/siCZ1HKBgmc44eFng3WsPJeLCdiaRYrhT9b dV1lsaEd5E92EwsZ6KHck5i6IEn+npho8XKzs/qVIu3IMO4jBqypJtDEvbQ6eds+ q1ZIRQ0661+RPuaE9TaR6T8fn7wd0WDWMVDkerzokGiRfFLR/30IYbt1FHx9vZCK 7IjyRQF46giUbOZOZMvdaWEv8YOjLBZZ1LA7TY97jSdnCOxZ+XNI00mP/W126PY3 ER7n8+mNBAGohaN+WgaeoqLGOv2XtcKYq1CirvqN0eGWFlDP4l45xZPIyeJYBU8+ kbSbG7I4fcvrSK0JA5GXYrjjpzNF8Bp6tTyft0zZPnBchBihorGj+IoXUONrU8+2 fVm7R98WCf6G+W+g3PYqZuKwW/NW7meclLBu8dyHT2MXEzybB1xplWP2+E/vuykW Ih/LqJwm6dn/AEs3Z6dWTSUKKg7YDPsJj04y9Fwd14XHj0Gc6PSGSuEXmT0VwjnR amdsWieyA0r6rCnoLQZqEiES/B+ObBe1/aL+/+i20s4vS6LGi8I= =/8YJ -----END PGP SIGNATURE-----
