CVE-2026-116130 HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request
CriticalCVSS 9.1
EPSS 0.59%
- Published
- Updated
- Exploit status
- No public exploit known
Description
HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.
The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.
A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cpan HTTP-Parser-XS | < 0.18 | 0.18 |
| debian/libhttp-parser-xs-perl(Debian:12) | All versions | No fix listed |
| debian/libhttp-parser-xs-perl(Debian:12) | = 0.17-2 | No fix listed |
| debian/libhttp-parser-xs-perl(Debian:12) | = 0.18-1 | No fix listed |
| debian/libhttp-parser-xs-perl(Debian:13) | All versions | No fix listed |
| debian/libhttp-parser-xs-perl(Debian:13) | = 0.17-2 | No fix listed |
| debian/libhttp-parser-xs-perl(Debian:13) | = 0.18-1 | No fix listed |
| debian/libhttp-parser-xs-perl(Debian:14) | < 0.18-1 | 0.18-1 |
| debian/libhttp-parser-xs-perl(Debian:14) | = 0.17-2 | No fix listed |
| ubuntu/libhttp-parser-xs-perl(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/libhttp-parser-xs-perl(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/libhttp-parser-xs-perl(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/libhttp-parser-xs-perl(Ubuntu:26.10) | All versions | No fix listed |
References
- Red Hat CVE page vendor-advisory
- Red Hat Bugzilla 2563991 issue-tracking
- www.cve.org
- nvd.nist.gov
- github.com patch
- metacpan.org release-notes
- www.openwall.com
- Debian Security Tracker CVE-2026-116130 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- bugs.debian.org issue-tracking