p5-Plack -- Multiple vulnerabilities

Plack project reports:

[SECURITY]

• Fix memory leak of every request env in Plack::Middleware::Recursive (CVE-2026-110333)
• Plack::Request::Upload->basename never returns '', '.' or '..' (CVE-2026-110332)
• Plack::App::URLMap matches SERVER_PORT literally when stripping it from Host (CVE-2026-110335)

[BUG FIXES]

• Plack::Middleware::ErrorDocument restores the env after a subrequest, so outer middleware such as AccessLog sees the original request (CVE-2026-110334)

[BUG FIXES]

• Document that Plack::Handler::FCGI and Apache2 keep dot segments in PATH_INFO and warn against relying on front-server path-based access control (CVE-2026-110336)

[source]