CVE-2026-65059 Details

A denial-of-service vulnerability has been identified in Furl versions through 3.15 for Perl. The issue arises from unbounded decompression of HTTP responses, which can lead to memory exhaustion. Furl improperly inflates response bodies compressed with gzip, x-gzip, or deflate Content-Encoding, appending the output to the response string without any size limit. This behavior occurs regardless of whether the request requested compression, and there are no options to limit the decompressed size. While responses written to files are streamed and do not consume memory, a malicious server or an attacker on an unencrypted HTTP connection can send a small compressed response that expands to deplete the client's memory, causing the process to terminate.

Users can apply the fix available in the GitHub pull request #139, which addresses this vulnerability by adding protection against such memory exhaustion attacks.