{"id":"CVE-2026-114629","kind":"vulnerability","aliases":["CVE-2026-114629"],"related":[],"title":"Web::Simple (Perl): Content-Length header drives unbounded memory allocation on form posts","description":"Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters.\n\nWeb::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation.\n\nAn attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.","summary":"Web::Simple before 0.035 allocates a buffer sized by the request's Content-Length header when reading urlencoded body parameters. A remote attacker can send a huge Content-Length with little or no body, forcing large memory allocation and likely denial of service.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","perl","self-hosted","web-simple"],"not_affected_if":["no-body-parameter-routes","no-web-simple"],"how_to_check":"- Check the installed version with `perl -MWeb::Simple -e 'print $Web::Simple::VERSION'` or `cpanm --info Web::Simple`\n- Search the codebase for `Web::Simple` and for dispatch rules using `%` body-parameter matches such as `POST + %name=`","fix":"- Upgrade Web::Simple to `0.035` or later\n- unknown whether a workaround exists beyond upgrading","status":"open","published_at":"2026-10-24T14:16:39+00:00","first_seen_at":"2026-10-24T14:48:21+00:00","triaged_at":"2026-10-25T04:51:46+00:00","updated_at":"2026-10-25T04:51:46+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:51:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Web::Simple to `0.035` or later\n- unknown whether a workaround exists beyond upgrading","reach":"internet","title":"Web::Simple (Perl): Content-Length header drives unbounded memory allocation on form posts","impact":"medium","summary":"Web::Simple before 0.035 allocates a buffer sized by the request's Content-Length header when reading urlencoded body parameters. A remote attacker can send a huge Content-Length with little or no body, forcing large memory allocation and likely denial of service.","category":"package","nicknames":[],"who_cares":["perl","web-simple","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote requests exhaust server memory, causing denial of service.","analyst_note":"Confirm the affected version range and whether there is a fix commit or workaround at the NVD entry and the Web::Simple changelog for 0.035.","how_to_check":"- Check the installed version with `perl -MWeb::Simple -e 'print $Web::Simple::VERSION'` or `cpanm --info Web::Simple`\n- Search the codebase for `Web::Simple` and for dispatch rules using `%` body-parameter matches such as `POST + %name=`","needs_analyst":true,"not_affected_if":["no-web-simple","no-body-parameter-routes"],"who_is_affected":"Applications built on Web::Simple that accept application/x-www-form-urlencoded POST bodies through routes with a % body-parameter match are exposed. The sources do not say whether front-end proxies or body size limits mitigate it, so teams with Web::Simple services that take form posts should treat them as in scope. Services that do not use Web::Simple, or that only serve routes without body-parameter matches, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000666,"input_tokens":3428,"output_tokens":646,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114629':17A,20A '-2026':16A,19A '0.035':32B,78C 'actual':172C 'alloc':11A,33B,68B,81C,139C 'application/x-www-form-urlencoded':104C 'attack':52B,141C 'authent':175C 'bodi':48B,64B,93C,100C,105C,154C,171C 'body-paramet':153C 'buffer':35B,83C,124C 'call':110C 'cap':113C 'content':5A,42B,58B,88C,135C,165C 'content-length':4A,41B,57B,87C,134C,164C 'cve':15A,18A 'declar':133C 'denial':71B 'determin':137C 'dispatch':96C,149C 'drive':8A 'far':167C 'forc':65B 'form':13A 'get':98C 'grow':122C 'header':7A,44B,90C 'host':25B 'huge':56B 'ignor':118C 'involv':177C 'larg':66B 'larger':168C 'length':6A,43B,59B,89C,128C,136C,166C 'like':70B 'littl':61B 'match':156C 'memori':10A,67B 'name':161C 'packag':21B 'paramet':49B,94C,155C 'parampars':97C 'perl':3A,22B,80C,119C 'post':14A,160C 'read':46B,102C,109C,121C,130C 'remot':51B 'request':39B,127C 'return':116C 'rout':147C 'self':24B 'self-host':23B 'send':54B,162C 'sent':173C 'servic':73B 'simpl':2A,28B,30B,75C 'singl':108C 'size':36B,84C 'specif':150C 'sub':159C 'trigger':143C 'unbound':9A 'unpack':99C 'urlencod':47B,92C 'use':106C 'valu':117C 'version':76C 'web':1A,27B,29B,74C,95C 'web-simpl':26B 'whose':148C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Web::Simple that accept application/x-www-form-urlencoded POST bodies through routes with a % body-parameter match are exposed. The sources do not say whether front-end proxies or body size limits mitigate it, so teams with Web::Simple services that take form posts should treat them as in scope. Services that do not use Web::Simple, or that only serve routes without body-parameter matches, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T14:16:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114629","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114629","severity":null,"published_at":"2026-10-24T14:16:39+00:00","modified_at":"2026-10-24T14:16:39+00:00","first_seen_at":"2026-10-24T14:48:21+00:00","fetched_at":"2026-10-24T14:48:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}