Log in Start free

Vulnerability · Published Oct 30, 2026 · Assigned by CPANSec

CVE-2026-116130HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request

Unrated

In plain English

A security flaw in HTTP-Parser-XS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS )–Not rated
Exploit odds (30 days)0.3%top 73.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libhttp-parser-xs-perlno fix listedDEBIAN-CVE-2026-116130
Debian:13libhttp-parser-xs-perlno fix listedDEBIAN-CVE-2026-116130
Debian:14libhttp-parser-xs-perl0.18-1DEBIAN-CVE-2026-116130
Ubuntu:22.04:LTSlibhttp-parser-xs-perlno fix listedUBUNTU-CVE-2026-116130
Ubuntu:24.04:LTSlibhttp-parser-xs-perlno fix listedUBUNTU-CVE-2026-116130
Ubuntu:26.04:LTSlibhttp-parser-xs-perlno fix listedUBUNTU-CVE-2026-116130
Ubuntu:26.10libhttp-parser-xs-perlno fix listedUBUNTU-CVE-2026-116130

Affected products (as reported)

VendorProductVersions
HTTP-Parser-XS 0 – before 0.18

Weakness: CWE-626

References