---
id: "CVE-2026-114629"
kind: "vulnerability"
aliases: ["CVE-2026-114629"]
title: "Web::Simple (Perl): Content-Length header drives unbounded memory allocation on form posts"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "perl", "self-hosted", "web-simple"]
not_affected_if: ["no-body-parameter-routes", "no-web-simple"]
published_at: "2026-10-24T14:16:39+00:00"
first_seen_at: "2026-10-24T14:48:21+00:00"
updated_at: "2026-10-25T04:51:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114629", "first_seen_at": "2026-10-24T14:48:21+00:00"}]
---

# Web::Simple (Perl): Content-Length header drives unbounded memory allocation on form posts

Web::Simple before 0.035 allocates a buffer sized by the request's Content-Length header when reading urlencoded body parameters. A remote attacker can send a huge Content-Length with little or no body, forcing large memory allocation and likely denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `perl -MWeb::Simple -e 'print $Web::Simple::VERSION'` or `cpanm --info Web::Simple`
- Search the codebase for `Web::Simple` and for dispatch rules using `%` body-parameter matches such as `POST + %name=`

## Fix

- Upgrade Web::Simple to `0.035` or later
- unknown whether a workaround exists beyond upgrading

## Timeline

- 2026-10-24T14:48:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114629

## From the sources

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters.

Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation.

An attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_