by Kastro
Paper/Archive/CVE-2026-116130

CVE-2026-116130

CPANSec — HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
33
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 26.2.262 × 205.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.

Affected

ProductAffectedFixed inSource
HTTP-Parser-XS< 0.180.18CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

patchgithub.com/kazuho/p5-http-parser-xs/commit/f388b9d7994722b01edd03d57de7d2fb819e1aae.patchrefmetacpan.org/release/KAZUHO/HTTP-Parser-XS-0.18/changesrefopenwall.com/lists/oss-security/2026/10/30/12