The vulnerability allows a cross‑origin WebSocket handshake, which uses the Extended CONNECT method, to be treated as a normal GET request. Because the Punk framework only performs an Origin check when a websocket‑specific route matches, the handshake passes through to any GET route in the application. An attacker can therefore open a WebSocket to an arbitrary path and, by observing the success or failure of the connection, determine whether that path returns a 2xx status. This effectively enables blind enumeration of all GET endpoints and could expose internal APIs or sensitive resources to unintended origins.

Affected systems include the Punk web framework for Perl, specifically versions 0.48 up to but not including 0.55. Any deployment of these releases that processes HTTP/2 or HTTP/3 requests and accepts WebSocket connections is vulnerable. The issue resides in the ps_serve_one routine, which does not validate the Origin header for Extended CONNECT traffic routed to generic GET handlers.

The vulnerability has a CVSS score of 5.3, indicating moderate risk, and an EPSS score of less than 1%, pointing to a very low probability of exploitation. It is not listed in the CISA KEV catalog. The attack vector requires the attacker to serve a malicious page that opens a WebSocket connection to a target server using HTTP/2 or HTTP/3. Because the handshake is accepted with a 2xx response only when the target route exists, an adversary can enumerate endpoints without triggering obvious server errors. Although the impact is limited to information disclosure through enumeration, it may assist in subsequent attacks such as credential harvesting or targeted API exploitation. The presence of an Origin check only on WebSocket routes narrows the ability to exploit more directly, but the blind mapping capability remains a significant risk, especially for applications exposing many GET handlers.