Web::Simple before 0.037 fails to escape single quotes
An oss-security post says HTML::Tags output from the Perl module leaves single quotes unescaped.
Stories per day · 30 days
3 RSS
Relateddenial-of-service14xss5cpan4http4memory-exhaustion4plack3web-simple3brotli2callbackery2cgi2code-execution2content-length2cpu-exhaustion2dbi2host-key2http-body2information-disclosure2multipart2
76 stories, newest first · one card per story
Stories tagged #perl
Plack::Middleware::CSP before 0.03 sends CSP under the wrong header
Browsers never enforce the policy, so Perl apps using the middleware get no Content-Security-Policy protection.
Monoceros before 0.30 can exhaust memory via Content-Length
A request that declares a large Content-Length can kill a Monoceros worker by exhausting memory.
RRD::CGI::Image before 0.01 blocks CGI via 'tz' parameter (CVE-2026-123776)
Passing a path in the 'tz' CGI query parameter blocks the Perl CGI process in versions through 0.01.
SQL::Abstract before 2.000003 allows SQL injection via arrayref (CVE-2026-121265)
Passing an arrayref column value in insert and update statements enables SQL injection in SQL::Abstract before 2.000003.
Perl HTTP::Body vulnerable to quadratic-time trailer parsing
HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.
SQL::Abstract and SQL::Abstract::Tree before 2.000001_04 for Perl allow SQL injection and XSS (CVE-2026-121007,…
Versions before 2.000001_04 allow SQL injection via where values in identifier position and XSS via unescaped SQL text and bind values.
CGI versions before 5.00 for Perl (20 CVEs)
20 CVEs in CGI and CGI::Cookie for Perl before 5.00 allow denial of service, CPU exhaustion and header spoofing.
Catalyst::Plugin::Authentication before 0.10029 allows timing attacks on passwords (CVE-2026-74846)
Legacy password verifier uses eq comparisons enabling timing attacks; fixed in version 0.10029.
Net::EasyTCP encryption key prediction vulnerability
Net::EasyTCP weak rand() function allows key prediction and sensitive data exposure.
Furl 3.15 fixes memory exhaustion in Perl HTTP decompression
Furl versions through 3.15 allow memory exhaustion via unbounded decompression of HTTP responses (CVE-2026-65059).
Google::Auth for Perl (2 CVEs)
Affects versions 0.11 through 0.12; no fixed versions or exploitation stated.
HTTP::Session for Perl vulnerable to memcached command injection
Affects versions before 0.54; no fixed version or exploitation stated.
XS::libbrotli before 1.2.1.0 vulnerable to out-of-bounds write (CVE-2026-115946)
XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with decoder out-of-bounds write vulnerability.
WebDyne for Perl has five CVEs including cookie and path traversal issues
WebDyne versions 2.014-3.022 for Perl issue insecure session cookies and allow path traversal in PSGI API.
CallBackery before 0.62.0 has password and session flaws
The note describes unsalted HMAC-SHA1 passwords, cookie forgery via rand(), and session cookies accepted at any age.
Business::GoCardless before 1.01 has three Perl webhook flaws
Empty webhook secrets accept forgeries, and unsigned legacy payloads can exhaust memory before verification.
Starlet before 0.33 for Perl has request-handling flaws
A large Content-Length can kill a worker, and chunked bodies from 0.20 can exhaust CPU.
HTTP::Parser::XS before 0.18 truncates PATH_INFO at encoded NUL
parse_http_request in the Perl module stops PATH_INFO at an encoded NUL byte; 0.18 is the fixed release.
CallBackery before 0.60.1 exposes POD via /doc path traversal
Unauthenticated clients can read the POD of any file through the Perl app’s /doc route; 0.60.1 is the fix.
DateTime::Lite before 0.8.1 allows CPU exhaustion (CVE-2026-87768)
Adding seconds can trigger a per-day loop in the Perl module; 0.8.1 is the fixed version named in the notice.
Spreadsheet::XLSX before 0.19 allows code execution via ExcelFmt eval
A crafted Excel number-format condition is passed to Perl string eval inside ExcelFmt.
MIME-tools before 5.521 for Perl fixes 10 CVEs
The visible flaws let one bad Content-Type parameter hide later parameters, including a multipart boundary.
Starman before 0.4019 has four Perl HTTP handling flaws
Named issues include an indefinite worker hold, CPU exhaustion on chunked bodies, and HEAD responses that desynchronize the connection.