Log in Start free

Vulnerability · Published Nov 2, 2026 · Assigned by CPANSec

CVE-2026-65059Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses

Unrated

In plain English

A security flaw in Furl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS )–Not rated
Exploit odds (30 days)0.2%top 86.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses. Furl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string with no size limit. It does this whether or not the request asked for compression, and no option caps the decompressed size. Responses read with write_file or write_code are streamed rather than held in memory. A malicious server, or an attacker on a plain HTTP connection, can send a small compressed response that expands to exhaust the client's memory and end the process.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libfurl-perlno fix listedDEBIAN-CVE-2026-65059
Debian:13libfurl-perlno fix listedDEBIAN-CVE-2026-65059
Debian:14libfurl-perlno fix listedDEBIAN-CVE-2026-65059
Ubuntu:22.04:LTSlibfurl-perlno fix listedUBUNTU-CVE-2026-65059
Ubuntu:24.04:LTSlibfurl-perlno fix listedUBUNTU-CVE-2026-65059
Ubuntu:26.04:LTSlibfurl-perlno fix listedUBUNTU-CVE-2026-65059
Ubuntu:26.10libfurl-perlno fix listedUBUNTU-CVE-2026-65059

Affected products (as reported)

VendorProductVersions
Furl 0 – through 3.15

Weakness: CWE-409

References