CVE-2026-116130 Details
Description
HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.
A vulnerability exists in HTTP::Parser::XS for Perl, specifically in versions prior to 0.18. The issue arises in the 'parse_http_request' function, where PATH_INFO is truncated at the first encoded NUL byte. This occurs because the XS parser URL-decodes the request path and measures the length using strlen(), leading to a premature termination of PATH_INFO. In contrast, the pure-Perl backend does not have this issue. As a result, a remote attacker can exploit this behavior by sending a path that is processed by a proxy or filter in its entirety, while the application only receives a shortened version.
Upgrade to HTTP::Parser::XS version 0.18 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kazuho/p5-http-parser-xs/commit/f388b9d7994722b01edd03d57de7d2fb819e1aae.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/KAZUHO/HTTP-Parser-XS-0.18/changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/10/30/12 | CVE | AdvisoryMailing ListRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-626 | Null Byte Interaction Error (Poison Null Byte) | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| HTTP::Parser::XS | < 0.18 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | CVE Modified | CVE |
| Oct 30, 2026 | New CVE Received | CPANSec |