Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-95811
Lemonldap-NG-Handler — Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L L N U N H N 6.5 .0040 32.4 —
AFFECTED
Product Versions Fixed
Lemonldap-NG-Handler 2.0.0 – —
TIMELINE
Sep 22 Reserved by CPANSec
Sep 25 EXPLOIT PUBLISHED — CVE-2026-95811 (Lemonldap-NG-Handler). Public exploit reference added.
Sep 25 Published (CNA: CPANSec)
Sep 26 EXPLOIT PUBLISHED — CVE-2026-95811 (Lemonldap-NG-Handler). Public exploit reference added.
Description
Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it.
The handler matches each vhost's locationRules regular expressions against REQUEST_URI, the raw request line, while the web server routes on the path it has already percent-decoded and normalized. A request that percent-encodes a character of the path, inserts dot segments, or doubles a slash therefore reaches the protected resource under a URI that no rule regexp matches, and the vhost's default rule decides access. Deny rules, identity and group conditions, and unprotect and skip rules are bypassed alike.
Only a vhost whose default rule is more permissive than its other rules is affected. An authenticated user then reaches any URL a locationRules regexp was meant to restrict, but gains no more than that default rule already grants.
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| September 22, 2026 | Reserved | Reserved by CPANSec |
| September 25, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-95811 (Lemonldap-NG-Handler). Public exploit reference added. |
| September 25, 2026 | Published | Published (CNA: CPANSec) |
| September 26, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-95811 (Lemonldap-NG-Handler). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| — | Lemonldap-NG-Handler | — | 2.0.0 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-95811 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
