CVE-2026-85491

Executive Summary

CVE-2026-85491 is a cache-poisoning vulnerability in the Perl module Catalyst::Seal versions prior to 0.03. The module memoizes action resolution results based solely on the request path, ignoring method, content type, scheme, or query parameters. This allows an attacker to populate the cache with a resolution for one request type (e.g., a GET) that then poisons the handling of a later, different request type (e.g., a POST), bypassing authorization checks or disabling routes entirely. Applications using Catalyst::Seal are affected, and the impact includes unauthorized access to privileged functionality and denial of service for legitimate users.

Technical Analysis

Catalyst::Seal replaces the dispatcher's prepare_action method with a version that memoizes how a path resolved: the dispatch type matched, the descent level, and leftover arguments. The memo key is the request path alone, omitting critical request attributes such as HTTP method, content type, scheme, or query parameters. This design flaw, classified as CWE-706 (Use of Incorrectly-Resolved Name or Reference), causes incorrect cache lookups when actions are role-based and depend on these omitted attributes.

An attacker can exploit this by sending a request that resolves to a less-privileged or no action, thereby caching that resolution. Subsequent requests to the same path—even with different methods or content types—replay the cached resolution. For example, if a path resolves to a POST-only action that is guarded by an authorization check, a GET request to that path may resolve to no action (or a shallower action) and cache that result. Later, a legitimate POST request will receive the cached resolution, skipping the authorization check and potentially triggering the deeper action without proper validation. This effectively disables the path for all future requests or misroutes them to an unintended action.

The memoization entry persists for the life of the process (until an action is registered, which typically happens at setup). The cache has a cap of 2048 entries, limiting how many distinct paths an attacker can poison per process. No authentication is required to trigger the vulnerability, as the attacker only needs to send HTTP requests to the affected application. The impact is severe: authorization checks can be bypassed, and denial of service can be induced for specific routes.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and NVD description. The exploitation steps are as follows:

1. Reconnaissance: The attacker identifies a web application running Catalyst with the Catalyst::Seal module (versions < 0.03). This can be done by fingerprinting the application's behavior, checking for known Catalyst headers, or observing error messages. The attacker maps routes that have different authorization requirements based on HTTP method (e.g., GET vs. POST).

2. Triggering the flaw: The attacker sends a request that will populate the memoization cache with a resolution that is beneficial to the attacker. For instance, to bypass an authorization check on a POST-only action, the attacker sends a GET request to the same path. If the GET request resolves to no action (because the action is POST-only), that "no action" resolution is cached under the path key. Alternatively, if a shallower action exists on the same path, the GET may resolve to that shallower action, caching that resolution. In both cases, the deeper, privileged action is never consulted.

3. Payload/execution: After the cache is poisoned, the attacker (or a legitimate user) sends the intended request (e.g., a POST request). The dispatcher uses the memoized resolution keyed by the path, which returns the cached result. If the cached result was "no action," the request fails, resulting in denial of service for that path. If the cached result was a shallower action, the request is dispatched to that action, possibly with an auto() guard preventing the deeper controller from running. This misroute can lead to unauthorized access if the shallower action lacks proper authorization checks.

4. Post-exploitation impact: The attacker can disable specific routes (DoS) or bypass authorization checks to access privileged functionality. Depending on the application, this could lead to data exposure, privilege escalation, or further exploitation. The attack is persistent for the life of the process, meaning the poisoned entry remains until the application restarts. The 2048-entry cap limits the number of paths that can be poisoned per process, but an attacker could target the most critical routes.

Impact Assessment

The vulnerability allows unauthenticated attackers to bypass authorization checks and cause denial of service on affected routes. The CVSS score is not available (N/A), but the potential impact is high: integrity and availability are at risk. Business impact includes unauthorized access to sensitive data or administrative functions, and disruption of legitimate user access. The blast radius is limited to applications using Catalyst::Seal versions prior to 0.03. Since the module is a Perl library, any web application built on Catalyst that incorporates this module is vulnerable. The attack is network-accessible, requires low complexity, and no privileges or user interaction.

Detection Guidance

Sigma Rule

title: Catalyst::Seal Memoization Poisoning Attempt
id: 3a4b5c6d-7e8f-9a0b-1c2d-3e4f5a6b7c8d
status: experimental
description: Detects potential exploitation of CVE-2026-85491 via anomalous request patterns targeting the same path with different HTTP methods.
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: apache
  service: access
detection:
  selection:
    cs-method:
      - 'GET'
      - 'POST'
    cs-uri-stem: '*'
  condition: selection
  timeframe: 5m
fields:
  - clientip
  - cs-method
  - cs-uri-stem
  - sc-status
falsepositives:
  - Legitimate applications that use both GET and POST on the same path for different purposes.
level: medium

YARA Rule

rule CVE_2026_85491_Catalyst_Seal_Memoization
{
    meta:
        description = "Detects Catalyst::Seal module versions before 0.03"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-85491"
        hash = ""
    strings:
        $seal_module = "Catalyst::Seal"
        $version_pattern = /0\.0[0-2]/
    condition:
        $seal_module and $version_pattern
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85491 Catalyst::Seal Memoization Poisoning Attempt"; flow:to_server,established; content:"GET"; http_method; content:"POST"; http_method; sameip; threshold: type both, track by_src, count 5, seconds 60; classtype:attempted-recon; sid:1000001; rev:1;)

Elastic Detection

sequence by source.ip, url.path with maxspan=5m
  [http where http.request.method == "GET"]
  [http where http.request.method == "POST" and url.path == url.path]

Splunk SPL Query

index=web sourcetype=access_combined
| stats count by clientip, uri_path, method
| where method="GET" OR method="POST"
| eventstats dc(method) as method_count by clientip, uri_path
| where method_count > 1
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100001" level="10">
    <if_sid>31100</if_sid>
    <description>CVE-2026-85491: Possible Catalyst::Seal memoization poisoning attempt</description>
    <regex>GET|POST</regex>
    <same_source_ip />
    <same_id />
    <frequency>5</frequency>
    <timeframe>60</timeframe>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Disable or remove the Catalyst::Seal module if not essential.
   • Implement a reverse proxy or WAF rule to block repeated requests to the same path with differing HTTP methods within a short timeframe.
   • Restrict access to sensitive routes via network controls or additional authentication layers.
   • Monitor logs for unusual patterns of GET/POST requests to the same path.

2. Patch/upgrade steps:

   • Upgrade Catalyst::Seal to version 0.03 or later. The fix ensures the memoization key includes all relevant request attributes (method, content type, scheme, query) to prevent incorrect cache hits.
   • If upgrade is not possible, apply a virtual patch by overriding the prepare_action method to include a composite key.

3. Long-term hardening:

   • Conduct a code review of all Catalyst applications to identify similar cache-key design flaws.
   • Implement robust caching mechanisms that incorporate all request dimensions.
   • Follow secure coding practices for authorization checks, ensuring they are not bypassed by caching layers.
   • Regularly update dependencies and monitor for CVEs in Perl modules.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-85491
• Catalyst::Seal on CPAN: https://metacpan.org/pod/Catalyst::Seal
• CWE-706: https://cwe.mitre.org/data/definitions/706.html
• Perl Security Advisory: https://perl.org/security/
• No known threat actor campaigns or exploit-in-the-wild evidence available.