CVE-2026-57488

A flaw was found in pupnp. An integer truncation vulnerability in the HTTP parser allows an adjacent network attacker to cause a Denial of Service DoS. When processing the Content-Length header on 64-bit systems, large integer values can truncate or wrap, causing the parser to miscalculate the...

SUSE CVE-2026-116130

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

OPENSUSE-SU-2026:12389-1 perl-HTTP-Parser-XS-0.180.0-1.1 on GA media

These are all security issues fixed in the perl-HTTP-Parser-XS-0.180.0-1.1 package on the GA media of openSUSE Tumbleweed...

Debian dla-4876 : python-aiohttp-doc - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4876 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4876-1 [email protected]...

tomcat-line-check

tomcat-line-check CVE-2026-24880 · GHSA-563x-q5rq-57qp —— Does Apache's upgrade to version 11.0.20, 10.1.52 or 9.0.116 actually apply to you? For most people it doesn't, and there are four different ways it doesn't apply. This tool scans your artifacts and tells you which one it is. java -jar...

CVE-2026-66731-Negative-Chunk-Size-Parsing-Causes-Memory-Corruption-leading-to-Server-Crash

Security Advisory: Negative Chunk-Size Parsing Causes Memory Corruption in facil.io Assigned CVE ID : CVE-2026-66731 Product: facil.io Affected versions: facil.io = 0.7.5 0.7.5, 0.7.6, master; introduced when the 0.8.x HTTP/1.1 parser was backported in 0.7.5 - not present in 0.6.x or 0.7.0–0.7.3...

CLEANSTART-2025-RY23854 HTTP parser in all current versions of Node

CVE-2018-7159 affects multiple packages. The HTTP parser in all current versions of Node. See references for individual vulnerability details...

CLEANSTART-2024-TS97808 LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces

Security vulnerability affects the suricata package. LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces...

CVE-2026-116130

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

Linux Distros Unpatched Vulnerability : CVE-2026-116130

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and...

CVE-2026-116130

A flaw was found in HTTP::Parser::XS. When processing HTTP request paths, the parser URL-decodes the path and terminates the string at decoded null bytes rather than using the full path length. A remote attacker can exploit this flaw by sending a crafted path containing an encoded null byte %00 t...

CVE-2026-116130

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

DEBIAN-CVE-2026-116130

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

CVE-2026-116130

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

CVE-2026-116130 HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

EUVD-2026-113904

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

CVE-2026-116130

The HTTP::Parser::XS Perl module (versions before 0.18 ) contains a vulnerability where the XS parser URL-decodes the request path and uses strlen() to measure the result. This causes the PATH_INFO to be truncated at the first byte decoded from an encoded NUL byte (%00 ). While the pure-Perl back...

CVE-2026-116130 HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

CVE-2026-116130: Null Byte Interaction Error (Poison Null Byte)

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

PT-2026-133523

Name of the Vulnerable Software and Affected Versions HTTP::Parser::XS versions prior to 0.18 Description An issue exists in the parse http request function where the XS parser URL-decodes the request path and measures the result using strlen. This causes the PATH INFO variable to be truncated at...