Reverse-Proxy versions before 0.04 for Perl allow an attacker to send a crafted HTTP request containing percent‑encoded characters in the URL path. The proxy decodes these bytes before appending them to the upstream request line, so a sequence such as %0d%0a becomes an actual CRLF character. The CRLF terminates the upstream request line, and the following client data is interpreted as a second, independent HTTP request. This enables an attacker to send arbitrary requests to the upstream application while the upstream believes the requests originated from the proxy.

The flaw is present in all releases of Reverse-Proxy older than 0.04, distributed in the Perl module Reverse::Proxy from the LNATION distribution. Upgrading to version 0.04 or later eliminates the vulnerability.

Any remote client that can send HTTP requests to the affected proxy can exploit the flaw; no local privileges or special conditions are required. The CVSS score of 5.3 indicates moderate severity, and the EPSS score is less than 1%, suggesting a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Request smuggling is a well‑known technique that can allow attackers to access routes or services not normally exposed through the proxy. The attack path is straightforward once a percent‑encoded CRLF sequence is used, making the potential impact significant if the upstream service is sensitive to arbitrary requests.