CVE-2026-116130

A flaw was found in HTTP::Parser::XS. When processing HTTP request paths, the parser URL-decodes the path and terminates the string at decoded null bytes rather than using the full path length. A remote attacker can exploit this flaw by sending a crafted path containing an encoded null byte %00 t...

CVE-2026-116130

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

CVE-2026-116130

The HTTP::Parser::XS module for Perl, in versions before 0.18 , is vulnerable to a Null Byte Interaction Error (CWE-626) . The XS parser URL-decodes the request path and uses strlen() to measure the result, causing PATH_INFO to be truncated at the first byte decoded from %00 . This issue specific...

CVE-2026-116130 HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

EUVD-2026-113904

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

CVE-2026-116130: Null Byte Interaction Error (Poison Null Byte)

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

PT-2026-133523

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH INFO at an encoded NUL byte in parse http request. The XS parser URL-decodes the request path and measures the result with strlen, so PATH INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote...