HTTP::Parser::XS before 0.18 truncates PATH_INFO at encoded NUL
Original title: CVE-2026-116130: HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request
parse_http_request in the Perl module stops PATH_INFO at an encoded NUL byte; 0.18 is the fixed release.
Robert Rothenberg reported CVE-2026-116130 in HTTP::Parser::XS for Perl. Versions before 0.18 truncate PATH_INFO at an encoded NUL byte inside parse_http_request. The notice points to the MetaCPAN distribution. No exploitation is mentioned in the available text.
Unconfirmed: The feed snippet does not state whether the truncation is exploitable in deployed applications.
- The affected function is parse_http_request.
- Versions before 0.18 are named as vulnerable.
- The report was posted to oss-security on October 30.
Impact: PATH_INFO truncated at an encoded NUL byte
| Product | Affected | Fixed in |
|---|---|---|
| HTTP::Parser::XS | before 0.18 | 0.18 |
- 1.Upgrade HTTP::Parser::XS to version 0.18.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-116130 | NUL-truncated PATH_INFO in HTTP::Parser::XS before 0.18 | — | — |
From the original article
Posted by Robert Rothenberg on Oct 30 ======================================================================== https://metacpan. org/dist/HTTP-Parser-XS VCS Repo: ...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.