Live › vulnerability › CVE-2026-116130
HTTP::Parser::XS before 0.18 URL-decodes the request path and measures it with strlen(), so PATH_INFO stops at an encoded %00 byte. An attacker can make a proxy or filter check one path while the application routes on a shorter one.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 13:30 UTC. All times on this page are UTC.
Perl applications that use the XS backend of HTTP::Parser::XS to parse requests and that depend on a proxy or filter checking the path before routing. The pure-Perl backend is not affected, so applications using only that backend can skip it.
No product ranges from the sources yet.
perl -MHTTP::Parser::XS -e 'print $HTTP::Parser::XS::VERSION'0.18 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.
The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.
A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.
This page as .md · .json · in your agent: get_signal("CVE-2026-116130")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.