CVE-2026-116135

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them. The decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no entry and is replaced with nothing, joining the bytes on either side. Hex digits in percent escapes are case-insensitive, and conforming decoders return the byte. A remote attacker can send a field name or value that a conforming decoder in front of the application reads differently, so that pass%aBword reaches the application as password.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-178

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

Upwind Security MDR@UpwindMDR1d
🚨 CRITICAL - Multiple DoS & Request Smuggling/Parsing Flaws in Perl HTTP::Body A batch of vulnerabilities has been disclosed in Perl's widely used HTTP::Body module (underlying Catalyst, Plack, Dancer, and other web frameworks): • CVE-2026-116135: Drops mixed-case percent-encoded characters, causing parser discrepancies/desync with front-end proxies. • CVE-2026-116531: Chunk boundary tracking loss in chunked transfer decoding, enabling request smuggling/hanging. • CVE-2026-116285 & CVE-2026-117500: Catastrophic ReDoS backtracking in chunked line size parsing and multipart basename suffixes leading to CPU exhaustion. • CVE-2026-116134: Unthrottled buffer growth causing memory exhaustion DoS. 👉 Affected: HTTP::Body < 1.24 | Upgrade to v1.24 (or latest distro package fixes) immediately
0000084
389 followersView on X

Explore more

Back to dashboard