CVE-2026-116130

{"id": "CVE-2026-116130", "cveTags": [], "metrics": {}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/kazuho/p5-http-parser-xs", "modules": ["HTTP::Parser::XS"], "versions": [{"status": "affected", "version": "0", "lessThan": "0.18", "versionType": "custom"}], "packageURL": "pkg:cpan/HTTP-Parser-XS", "packageName": "HTTP-Parser-XS", "programFiles": ["XS.xs"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "HTTP::Parser::XS::parse_http_request"}]}]}], "published": "2026-10-30T13:18:31.407", "references": [{"url": "https://github.com/kazuho/p5-http-parser-xs/commit/f388b9d7994722b01edd03d57de7d2fb819e1aae.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/KAZUHO/HTTP-Parser-XS-0.18/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/10/30/12", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-626"}]}], "descriptions": [{"lang": "en", "value": "HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.\n\nThe XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.\n\nA remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one."}], "lastModified": "2026-10-30T19:39:14.897", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}