CVE-2026-116130

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...