HTTP::Parser::XS: PATH_INFO truncation via encoded NUL byte (CVE-2026-116130)

The Perl module HTTP::Parser::XS contains a vulnerability (CVE-2026-116130) where the parse_http_request function improperly handles encoded NUL bytes. This flaw causes the PATH_INFO variable to truncate at the NUL byte. Web applications that use this module for routing or path-based access control may misinterpret the request path, potentially leading to unauthorized access if security checks are bypassed.

Impact

Applications relying on HTTP::Parser::XS for path-based authorization may be susceptible to security bypasses. An attacker could craft a request containing an encoded NUL byte (e.g., %00) to manipulate how the application perceives the requested resource, potentially accessing restricted paths that would otherwise be blocked by validation logic.

Recommendation

• Inventory all Perl applications utilizing the HTTP-Parser-XS module.
• Upgrade HTTP::Parser::XS to version 0.18 or later across all environments.
• Review application logic that performs path-based access control to ensure it does not rely solely on input parsed by vulnerable versions of HTTP::Parser::XS.