Furl 3.15 fixes memory exhaustion in Perl HTTP decompression
Original title: CVE-2026-65059: Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses
Furl versions through 3.15 allow memory exhaustion via unbounded decompression of HTTP responses (CVE-2026-65059).
The Furl Perl module versions up to 3.15 are vulnerable to memory exhaustion when decompressing HTTP responses unboundedly. This issue was disclosed on oss-security. Users should upgrade to 3.15 or later.
- Affects Furl < 3.15 in Perl
- Vulnerability allows memory exhaustion via unbounded decompression
- Reported in oss-security
- Metacpan link provided
Impact: memory exhaustion via unbounded decompression of HTTP responses
- 1.Upgrade to Furl 3.15
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65059 | Memory exhaustion in Furl Perl HTTP decompression < 3.16 | 7.5 | — |
From the original article
Posted by Robert Rothenberg on Nov 02 ======================================================================== https://metacpan. org/dist/Furl https://github. com/tokuhirom/Furl...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.