CVE-2026-116135: falha em HTTP-Body
HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.3%
HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them.
The decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no entry and is replaced with nothing, joining the bytes on either side. Hex digits in percent escapes are case-insensitive, and conforming decoders return the byte.
A remote attacker can send a field name or value that a conforming decoder in front of the application reads differently, so that pass%aBword reaches the application as password.
Produtos afetados
HTTP-BodyCVEs relacionadas — HTTP-Body
No mesmo produto, das mais perigosas para as menos.
CVE-2026-116132—HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on diskEPSS 0.3%CVE-2026-116134—HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header blockEPSS 0.3%CVE-2026-116133—HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundaryEPSS 0.3%CVE-2026-116131—HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart partsEPSS 0.3%CVE-2026-116531—HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunkEPSS 0.3%CVE-2026-116285—HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodiesEPSS 0.3%