{"id":"CVE-2026-95811","aliases":["DEBIAN-CVE-2026-95811","EUVD-2026-86497","GHSA-3rh3-f3vh-mgjh","UBUNTU-CVE-2026-95811"],"status":"published","title":"Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it","description":"Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it.\n\nThe handler matches each vhost's locationRules regular expressions against REQUEST_URI, the raw request line, while the web server routes on the path it has already percent-decoded and normalized. A request that percent-encodes a character of the path, inserts dot segments, or doubles a slash therefore reaches the protected resource under a URI that no rule regexp matches, and the vhost's default rule decides access. Deny rules, identity and group conditions, and unprotect and skip rules are bypassed alike.\n\nOnly a vhost whose default rule is more permissive than its other rules is affected. An authenticated user then reaches any URL a locationRules regexp was meant to restrict, but gains no more than that default rule already grants.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00551,"percentile":0.46551,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-180","CWE-863"],"published":"2026-09-25T01:31:22Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"Debian:12","package":"lemonldap-ng","fixed_in":["2.16.1+ds-deb12u10"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lemonldap-ng","fixed_in":["2.21.2+ds-1+deb13u4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lemonldap-ng","fixed_in":["2.23.4+ds-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"lemonldap-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.1+ds-deb12u10"}]}],"versions":["2.16.1+ds-2","2.16.1+ds-deb12u1","2.16.1+ds-deb12u2","2.16.1+ds-deb12u3","2.16.1+ds-deb12u4","2.16.1+ds-deb12u5","2.16.1+ds-deb12u6","2.16.1+ds-deb12u7","2.16.1+ds-deb12u8","2.16.1+ds-deb12u9"]},{"source":"osv","ecosystem":"Debian:13","package":"lemonldap-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.2+ds-1+deb13u4"}]}],"versions":["2.21.2+ds-1","2.21.2+ds-1+deb13u1","2.21.2+ds-1+deb13u2","2.21.2+ds-1+deb13u3"]},{"source":"osv","ecosystem":"Debian:14","package":"lemonldap-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23.4+ds-1"}]}],"versions":["2.21.2+ds-1","2.21.2+ds-2","2.21.3+ds-1","2.21.3+ds-1~bpo12+1","2.21.3+ds-1~bpo13+1","2.22.0+ds-1","2.22.0+ds-2","2.22.0+ds-2~bpo13+1","2.22.1+ds-1","2.22.1+ds-1~bpo13+1","2.22.2+ds-1","2.22.2+ds-1~bpo13+1","2.22.3+ds-1","2.22.3+ds-1~bpo13+1","2.23.0+ds-1","2.23.0+ds-2","2.23.0+ds-3","2.23.0+ds-3~bpo13+1","2.23.0+ds-4","2.23.1+ds-1","2.23.2+ds-1","2.23.2+ds-1~bpo13+1","2.23.2+ds-2","2.23.3+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"lemonldap-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.3-1","1.4.6-1","1.4.6-2","1.4.6-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"lemonldap-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.10-1","1.9.13-2","1.9.14-1","1.9.15-1","1.9.16-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lemonldap-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.5+ds-2","2.0.6+ds-2","2.0.7+ds-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"lemonldap-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.11+ds-4","2.0.13+ds-3","2.0.13+ds-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"lemonldap-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.2+ds-1","2.17.1+ds-1","2.17.2+ds-1","2.17.2+ds-2","2.18.1+ds-1","2.18.2+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"lemonldap-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.22.2+ds-1","2.22.3+ds-1","2.23.0+ds-3","2.23.0+ds-4","2.23.2+ds-1","2.23.2+ds-2","2.23.3+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"lemonldap-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.21.0+ds-3","2.22.0+ds-2","2.22.1+ds-1","2.22.2+ds-1"]}],"references":[{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/3723","tags":["issue-tracking","report"]},{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.23.4","tags":["release-notes","advisory"]},{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.21.6","tags":["release-notes","advisory"]},{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.16.10","tags":["release-notes","advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-24660","tags":["related","web"]},{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/3723","tags":["exploit","evidence","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/09/msg00032.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95811","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3rh3-f3vh-mgjh"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95811.json","tags":["advisory"]},{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-95811","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-95811","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-95811","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-95811","title":"Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it","description":"Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it.\n\nThe handler matches each vhost's locationRules regular expressions against REQUEST_URI, the raw request line, while the web server routes on the path it has already percent-decoded and normalized. A request that percent-encodes a character of the path, inserts dot segments, or doubles a slash therefore reaches the protected resource under a URI that no rule regexp matches, and the vhost's default rule decides access. Deny rules, identity and group conditions, and unprotect and skip rules are bypassed alike.\n\nOnly a vhost whose default rule is more permissive than its other rules is affected. An authenticated user then reaches any URL a locationRules regexp was meant to restrict, but gains no more than that default rule already grants.","status":"published","published":"2026-09-25T01:31:22.472Z","modified":"2026-09-26T15:07:03.342Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-863","CWE-180"],"updated_at":"2026-11-02T14:20:05.505362Z"}],"euvd":[{"id":"EUVD-2026-86497","description":"Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it.\n\nThe handler matches each vhost's locationRules regular expressions against REQUEST_URI, the raw request line, while the web server routes on the path it has already percent-decoded and normalized. A request that percent-encodes a character of the path, inserts dot segments, or doubles a slash therefore reaches the protected resource under a URI that no rule regexp matches, and the vhost's default rule decides access. Deny rules, identity and group conditions, and unprotect and skip rules are bypassed alike.\n\nOnly a vhost whose default rule is more permissive than its other rules is affected. An authenticated user then reaches any URL a locationRules regexp was meant to restrict, but gains no more than that default rule already grants.","status":"published","published":"2026-09-25T01:31:22Z","modified":"2026-09-26T15:07:03Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:54.622662Z"}],"ghsa":[{"id":"GHSA-3rh3-f3vh-mgjh","title":"Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0...","description":"Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it.\n\nThe handler matches each vhost's locationRules regular expressions against REQUEST_URI, the raw request line, while the web server routes on the path it has already percent-decoded and normalized. A request that percent-encodes a character of the path, inserts dot segments, or doubles a slash therefore reaches the protected resource under a URI that no rule regexp matches, and the vhost's default rule decides access. Deny rules, identity and group conditions, and unprotect and skip rules are bypassed alike.\n\nOnly a vhost whose default rule is more permissive than its other rules is affected. An authenticated user then reaches any URL a locationRules regexp was meant to restrict, but gains no more than that default rule already grants.","status":"published","published":"2026-09-25T03:31:00Z","modified":"2026-09-26T18:31:01Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-180"],"updated_at":"2026-11-02T15:12:30.689958Z"}],"nvd":[{"id":"CVE-2026-95811","description":"Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it.\n\nThe handler matches each vhost's locationRules regular expressions against REQUEST_URI, the raw request line, while the web server routes on the path it has already percent-decoded and normalized. A request that percent-encodes a character of the path, inserts dot segments, or doubles a slash therefore reaches the protected resource under a URI that no rule regexp matches, and the vhost's default rule decides access. Deny rules, identity and group conditions, and unprotect and skip rules are bypassed alike.\n\nOnly a vhost whose default rule is more permissive than its other rules is affected. An authenticated user then reaches any URL a locationRules regexp was meant to restrict, but gains no more than that default rule already grants.","status":"published","published":"2026-09-25T02:16:54.677Z","modified":"2026-09-26T16:16:39.087Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-180","CWE-863"],"updated_at":"2026-11-02T14:12:51.388161Z"}],"osv":[{"id":"CVE-2026-95811","title":"Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it","description":"Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it.\n\nThe handler matches each vhost's locationRules regular expressions against REQUEST_URI, the raw request line, while the web server routes on the path it has already percent-decoded and normalized. A request that percent-encodes a character of the path, inserts dot segments, or doubles a slash therefore reaches the protected resource under a URI that no rule regexp matches, and the vhost's default rule decides access. Deny rules, identity and group conditions, and unprotect and skip rules are bypassed alike.\n\nOnly a vhost whose default rule is more permissive than its other rules is affected. An authenticated user then reaches any URL a locationRules regexp was meant to restrict, but gains no more than that default rule already grants.","status":"published","published":"2026-09-25T01:31:22.472Z","modified":"2026-10-28T02:30:45.73834136Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-180","CWE-863"],"updated_at":"2026-11-02T15:45:21.262447Z"},{"id":"DEBIAN-CVE-2026-95811","description":"Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it.  The handler matches each vhost's locationRules regular expressions against REQUEST_URI, the raw request line, while the web server routes on the path it has already percent-decoded and normalized. A request that percent-encodes a character of the path, inserts dot segments, or doubles a slash therefore reaches the protected resource under a URI that no rule regexp matches, and the vhost's default rule decides access. Deny rules, identity and group conditions, and unprotect and skip rules are bypassed alike.  Only a vhost whose default rule is more permissive than its other rules is affected. An authenticated user then reaches any URL a locationRules regexp was meant to restrict, but gains no more than that default rule already grants.","status":"published","published":"2026-09-25T02:16:54.677Z","modified":"2026-10-18T04:00:09.489085893Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:07.324252Z"},{"id":"UBUNTU-CVE-2026-95811","description":"Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it. The handler matches each vhost's locationRules regular expressions against REQUEST_URI, the raw request line, while the web server routes on the path it has already percent-decoded and normalized. A request that percent-encodes a character of the path, inserts dot segments, or doubles a slash therefore reaches the protected resource under a URI that no rule regexp matches, and the vhost's default rule decides access. Deny rules, identity and group conditions, and unprotect and skip rules are bypassed alike. Only a vhost whose default rule is more permissive than its other rules is affected. An authenticated user then reaches any URL a locationRules regexp was meant to restrict, but gains no more than that default rule already grants.","status":"published","published":"2026-09-25T02:16:00Z","modified":"2026-10-17T13:01:19.552135679Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:57:44.071534Z"}]}}