CVE-2026-125729: Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it

[Robert Rothenberg <rrwo () cpansec org>]

========================================================================
CVE-2026-125729                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-125729

  Distribution:  Plack-Middleware-CSP
      Versions:  before 0.03
      MetaCPAN:  https://metacpan.org/dist/Plack-Middleware-CSP
      VCS Repo:  https://github.com/pangyre/Plack-Middleware-CSP/


Plack::Middleware::CSP versions before 0.03 for Perl send the Content
Security Policy under the wrong header name, so browsers never enforce
it

Description
-----------
Plack::Middleware::CSP versions before 0.03 for Perl send the Content
Security Policy under the wrong header name, so browsers never enforce
it.

The call method sets the policy in a response header named
"content-security-protocol" instead of "Content-Security-Policy".
Browsers ignore that header.

Any cross-site scripting flaw in the wrapped application can run
scripts the policy was meant to block.

Problem types
-------------
- CWE-684 Incorrect Provision of Specified Functionality

Solutions
---------
Upgrade to Plack-Middleware-CSP 0.03 or later.

References
----------
https://github.com/pangyre/Plack-Middleware-CSP/issues/1
https://metacpan.org/release/ASHLEY/Plack-Middleware-CSP-0.03/source/CHANGES