---
id: "CVE-2026-116135"
kind: "vulnerability"
aliases: ["CVE-2026-116135"]
title: "Perl HTTP::Body: mixed-case percent escapes dropped from form fields"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["http-body", "package", "perl", "web-apps"]
not_affected_if: ["no-http-body-dependency"]
published_at: "2026-10-28T18:17:12+00:00"
first_seen_at: "2026-10-28T18:34:33+00:00"
updated_at: "2026-10-28T18:35:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116135", "first_seen_at": "2026-10-28T18:34:33+00:00"}]
---

# Perl HTTP::Body: mixed-case percent escapes dropped from form fields

HTTP::Body for Perl drops percent escapes written with mixed-case hex digits (such as %aB) from urlencoded form fields instead of decoding them. An attacker can send a field name or value that a conforming decoder in front of the app reads differently, so a request for pass%aBword reaches the application as password.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed HTTP::Body version with `perl -MHTTP::Body -e 'print $HTTP::Body::VERSION'`
- Look for HTTP::Body in the application's cpanfile, cpanfile.snapshot or Makefile.PL dependency lists
- Check whether a proxy or WAF decodes form fields before the Perl app sees them, since a mismatch between decoders is what makes this exploitable

## Fix

- Upgrade HTTP::Body to `1.23_01` or later
- unknown whether a patched release number beyond that is needed or what the upstream fix commit contains

## Timeline

- 2026-10-28T18:34:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116135

## From the sources

HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them.

The decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no entry and is replaced with nothing, joining the bytes on either side. Hex digits in percent escapes are case-insensitive, and conforming decoders return the byte.

A remote attacker can send a field name or value that a conforming decoder in front of the application reads differently, so that pass%aBword reaches the application as password.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_