CVE-2026-116130: HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request

As cited

Copy frozen at 2026-10-30 13:52 UTC (site build).

vulnerabilities

CVE-2026-116130: HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request

CVE-2026-116130 affects HTTP::Parser::XS, a Perl module for HTTP request parsing, in versions before 0.18. The vulnerability allows HTTP requests with encoded null bytes in PATH_INFO to be truncated during parsing by the parse_http_request function.

Why it matters: Developers and operators using HTTP::Parser::XS versions before 0.18 in Perl applications should update immediately, as path truncation could allow attackers to bypass access controls or routing logic.

Source published

2026-10-30 12:54 UTC

First seen by Cybersecurity Tracker

2026-10-30 13:02 UTC