CVE-2026-114629

{"id": "CVE-2026-114629", "cveTags": [], "metrics": {}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/p5sagit/Web-Simple", "modules": ["Web::Simple"], "versions": [{"status": "affected", "version": "0", "lessThan": "0.035", "versionType": "custom"}], "packageURL": "pkg:cpan/Web-Simple", "packageName": "Web-Simple", "programFiles": ["lib/Web/Dispatch/ParamParser.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Web::Dispatch::ParamParser::get_unpacked_body_from"}]}]}], "published": "2026-10-24T14:16:39.187", "references": [{"url": "https://github.com/p5sagit/Web-Simple/commit/7e02c4f6204a2898938d357e6efe6dc2679af695.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/ETHER/Web-Simple-0.035/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/10/24/4", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-789"}]}], "descriptions": [{"lang": "en", "value": "Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters.\n\nWeb::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation.\n\nAn attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved."}], "lastModified": "2026-10-26T18:39:42.503", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}