PSA-2026-00089: Proxmox: Several issues in libpve-http-server-perl
This Proxmox advisory covers a security issue in Proxmox Virtual Environment and Proxmox Mail Gateway.
Key facts
- Fixed in
- libpve-http-server-perl 6.0.6
- Advisory id
- PSA-2026-00089
- Source published
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
Several issues were found and fixed in the Perl HTTP server used by Proxmox VE and Proxmox Mail Gateway. The access log handling was improved to avoid interleaved writes to the log file and injection of unescaped special values in log lines.
The request handling was improved to reject duplicate Content-Length, Host or Cookie HTTP header values, to avoid mapping underscores to hyphens in HTTP header names and to reject requests with extremely long query strings. The duplicate header value issue was reported privately by Apo - CSB Raccoon Labs, the rest was found internally.
Packages: libpve-http-server-perl.
Affected products named by the advisory: Proxmox Virtual Environment.
Text from the source record.
Fix and mitigation
Upgrade to a fixed release named by Proxmox:
- libpve-http-server-perl 6.0.6
Vendor guidance
- Update to the fixed package versions: libpve-http-server-perl >= 6.0.6.
Support dates for the fixed release lines
- Proxmox VE 6: support ended
More Proxmox advisories
PSA-2026-00095Nov 10, 2026Proxmox Virtual Environment: Broken privilege checks when modifying container NICsPSA-2026-00094Nov 10, 2026Proxmox Virtual Environment: OCI extraction path escapePSA-2026-00093Nov 10, 2026Proxmox Virtual Environment: FRR config injection issuesPSA-2026-00092Nov 10, 2026Proxmox Virtual Environment: Missing and incomplete ACL checks in the SDN APICVE-2026-116264Nov 10, 2026Proxmox Mail Gateway: Several issues in libmime-tools-perlPSA-2026-00090Nov 10, 2026Proxmox Mail Gateway: XSS in content-type display in quarantine views
Get an email when Proxmox Virtual Environment (VE) publishes the next one.
See Proxmox Virtual Environment (VE)'s last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Proxmox Proxmox Virtual Environment from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
