CVE-2026-116130
Severity not reportedHTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.
HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/kazuho/p5-http-parser-xs/commit/f388b9d7994722b01edd03d57de7d2fb819e1aa... 9b29abf9-4ab0-4765-b253-1875cd9b441e
- https://metacpan.org/release/KAZUHO/HTTP-Parser-XS-0.18/changes 9b29abf9-4ab0-4765-b253-1875cd9b441e
- http://www.openwall.com/lists/oss-security/2026/10/30/12 af854a3a-2127-422b-91ae-364da2661108