Live › vulnerability › CVE-2026-116135
Go to dashboardHTTP::Body for Perl drops percent escapes written with mixed-case hex digits (such as %aB) from urlencoded form fields instead of decoding them. An attacker can send a field name or value that a conforming decoder in front of the app reads differently, so a request for pass%aBword reaches the application as password.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Applications that parse urlencoded form bodies with HTTP::Body and sit behind a component that decodes the same fields differently, such as a proxy, WAF or access-control layer. Applications that do not use HTTP::Body, or that have no decoder in front that interprets fields differently, are less exposed; the sources do not say how common such a setup is.
No product ranges from the sources yet.
perl -MHTTP::Body -e 'print $HTTP::Body::VERSION'1.23_01 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them.
The decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no entry and is replaced with nothing, joining the bytes on either side. Hex digits in percent escapes are case-insensitive, and conforming decoders return the byte.
A remote attacker can send a field name or value that a conforming decoder in front of the application reads differently, so that pass%aBword reaches the application as password.
This page as .md · .json · in your agent: get_signal("CVE-2026-116135")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.