Cpe:2.3:a:http-Parser-Xs_project:http-Parser-Xs:*:*:*:*:*:perl:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ahttp-parser-xs_projecthttp-parser-xsperl/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 19:51:56 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgHTTP::Parser::XS: PATH_INFO truncation via encoded NUL byte (CVE-2026-116130)https://feed.craftedsignal.io/briefs/2026-10-http-parser-xs-path-truncation/Sat, 31 Oct 2026 19:51:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-http-parser-xs-path-truncation/HTTP::Parser::XS versions before 0.18 for Perl are vulnerable to PATH_INFO truncation when an encoded NUL byte is present in the request path, potentially enabling security bypasses in downstream applications.The Perl module HTTP::Parser::XS contains a vulnerability (CVE-2026-116130) where the parse_http_request function improperly handles encoded NUL bytes. This flaw causes the PATH_INFO variable to truncate at the NUL byte. Web applications that use this module for routing or path-based access control may misinterpret the request path, potentially leading to unauthorized access if security checks are bypassed.

Impact

Applications relying on HTTP::Parser::XS for path-based authorization may be susceptible to security bypasses. An attacker could craft a request containing an encoded NUL byte (e.g., %00) to manipulate how the application perceives the requested resource, potentially accessing restricted paths that would otherwise be blocked by validation logic.

Recommendation

  • Inventory all Perl applications utilizing the HTTP-Parser-XS module.
  • Upgrade HTTP::Parser::XS to version 0.18 or later across all environments.
  • Review application logic that performs path-based access control to ensure it does not rely solely on input parsed by vulnerable versions of HTTP::Parser::XS.
]]>mediumadvisory