Live › vulnerability › CVE-2026-114629
Go to dashboardWeb::Simple before 0.035 allocates a buffer sized by the request's Content-Length header when reading urlencoded body parameters. A remote attacker can send a huge Content-Length with little or no body, forcing large memory allocation and likely denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 14:48 UTC. All times on this page are UTC.
Applications built on Web::Simple that accept application/x-www-form-urlencoded POST bodies through routes with a % body-parameter match are exposed. The sources do not say whether front-end proxies or body size limits mitigate it, so teams with Web::Simple services that take form posts should treat them as in scope. Services that do not use Web::Simple, or that only serve routes without body-parameter matches, can skip it.
No product ranges from the sources yet.
perl -MWeb::Simple -e 'print $Web::Simple::VERSION' or cpanm --info Web::SimpleWeb::Simple and for dispatch rules using % body-parameter matches such as POST + %name=0.035 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters.
Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation.
An attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.
This page as .md · .json · in your agent: get_signal("CVE-2026-114629")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.