RRWO vulnerabilities
We track 13 vulnerabilities in RRWO products across 13 products. 13 are rated high or critical, and none are known to be exploited. The most recent was published on August 12, 2026.
Latest RRWO vulnerabilities
- 7.5 High severity
Net::CIDR::Set: Memory Allocation with Excessive Size Value
Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The _encode method accepts any prefix length matching `(0|[1-9][0-9]*)` and passes it to _width2bits(), which builds the mask as `'
- 7.5 High severity
Data::Entropy: Cleartext Transmission of Sensitive Information
Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomO
- 9.1 Critical severity
Plack::App::Prerender: Server-Side Request Forgery
Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call. When the rewrite base is a plain string, the REQUEST_URI is appended to it, with no check that the path starts with a forward
- 9.8 Critical severity
Catalyst::View::Wkhtmltopdf: Improper Neutralization of Special Elements used in an OS Command
Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as
- 7.3 High severity
Net::CIDR::Set: Improper Validation of Unsafe Equivalence in Input
Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. The mask portion of a network mask could contain Unicode digits such as the Arabic-Indic One (U+0661), or non-digits, which were ignored. This could allow network masks to accept lar
- 7.5 High severity
Net::CIDR::Set: Uncontrolled Recursion
Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses. The add method called the _encode method to parse addresses. If the addresses did not look like netmasks or network ranges, then they were assumed to single IP addresses and passed ba
- 7.3 High severity
Plack::Middleware::Security::Common: Improper Neutralization of CRLF Sequences in HTTP Headers
Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example, GET
- 9.1 Critical severity
Crypt::SaltedHash: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.
- 7.5 High severity
Crypt::SaltedHash: Observable Timing Discrepancy
Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash.
- 7.3 High severity
Net::Statsd::Lite: Improper Neutralization of CRLF Sequences
Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections. The values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Note that version
- 8.2 High severity
Net::Statsd::Tiny: Improper Neutralization of CRLF Sequences
Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections. The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.
- 7.5 High severity
Catalyst::Plugin::Statsd: Cleartext Transmission of Sensitive Information
Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids. If the communication channel to the statsd daemon is not secured (for example, by sending UDP packets to a host on another network), then users' session ids may be leaked. This may
- 7.5 High severity
Text::Minify::XS: Heap-based Buffer Overflow
Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters. The minify functions mishandled some malformed UTF-8 characters, leading to heap corruption. Note that the minify_utf8 function is