CVE-2026-116130

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116130", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-10-25T10:58:24.860Z", "datePublished": "2026-10-30T12:38:27.038Z", "dateUpdated": "2026-11-06T16:41:08.545Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["HTTP::Parser::XS"], "packageName": "HTTP-Parser-XS", "packageURL": "pkg:cpan/HTTP-Parser-XS", "programFiles": ["XS.xs"], "programRoutines": [{"name": "HTTP::Parser::XS::parse_http_request"}], "repo": "https://github.com/kazuho/p5-http-parser-xs", "versions": [{"lessThan": "0.18", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.\n\nThe XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.\n\nA remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-626", "description": "CWE-626 Null Byte Interaction Error (Poison Null Byte)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-30T12:38:27.038Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/kazuho/p5-http-parser-xs/commit/f388b9d7994722b01edd03d57de7d2fb819e1aae.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/KAZUHO/HTTP-Parser-XS-0.18/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to HTTP-Parser-XS 0.18 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/30/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-30T15:05:28.040Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T16:40:33.779841Z", "id": "CVE-2026-116130", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:41:08.545Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/30/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-30T15:05:28.040Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-116130", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T16:40:33.779841Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:40:52.694Z"}}], "cna": {"title": "HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/kazuho/p5-http-parser-xs", "modules": ["HTTP::Parser::XS"], "versions": [{"status": "affected", "version": "0", "lessThan": "0.18", "versionType": "custom"}], "packageURL": "pkg:cpan/HTTP-Parser-XS", "packageName": "HTTP-Parser-XS", "programFiles": ["XS.xs"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "HTTP::Parser::XS::parse_http_request"}]}], "solutions": [{"lang": "en", "value": "Upgrade to HTTP-Parser-XS 0.18 or later."}], "references": [{"url": "https://github.com/kazuho/p5-http-parser-xs/commit/f388b9d7994722b01edd03d57de7d2fb819e1aae.patch", "tags": ["patch"]}, {"url": "https://metacpan.org/release/KAZUHO/HTTP-Parser-XS-0.18/changes", "tags": ["release-notes"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.\n\nThe XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.\n\nA remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-626", "description": "CWE-626 Null Byte Interaction Error (Poison Null Byte)"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-30T12:38:27.038Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116130", "state": "PUBLISHED", "dateUpdated": "2026-11-06T16:41:08.545Z", "dateReserved": "2026-10-25T10:58:24.860Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-10-30T12:38:27.038Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["HTTP::Parser::XS"], "packageName": "HTTP-Parser-XS", "packageURL": "pkg:cpan/HTTP-Parser-XS", "programFiles": ["XS.xs"], "programRoutines": [{"name": "HTTP::Parser::XS::parse_http_request"}], "repo": "https://github.com/kazuho/p5-http-parser-xs", "versions": [{"lessThan": "0.18", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.\n\nThe XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.\n\nA remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one."}], "id": "CVE-2026-116130", "lastModified": "2026-11-06T17:17:14.347", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116130", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T16:40:33.779841Z", "version": "2.0.3"}}]}, "published": "2026-10-30T13:18:31.407", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/kazuho/p5-http-parser-xs/commit/f388b9d7994722b01edd03d57de7d2fb819e1aae.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/KAZUHO/HTTP-Parser-XS-0.18/changes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/30/12"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-626"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-http-parser-xs: HTTP::Parser::XS: Security control bypass via path truncation on encoded null bytes", "id": "2563991", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563991"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-464", "details": ["HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.\nThe XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.\nA remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.", "A flaw was found in HTTP::Parser::XS. When processing HTTP request paths, the parser URL-decodes the path and terminates the string at decoded null bytes rather than using the full path length. A remote attacker can exploit this flaw by sending a crafted path containing an encoded null byte (%00) to create a discrepancy between frontend security proxies and backend routing, potentially bypassing access control restrictions."], "name": "CVE-2026-116130", "public_date": "2026-10-30T12:38:27Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116130\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116130\nhttps://github.com/kazuho/p5-http-parser-xs/commit/f388b9d7994722b01edd03d57de7d2fb819e1aae.patch\nhttps://metacpan.org/release/KAZUHO/HTTP-Parser-XS-0.18/changes"], "statement": "This vulnerability is rated as Moderate because exploitation requires a multi-tier web architecture where front-end filtering proxies disagree with backend request handling, limiting the flaw to authorization discrepancies rather than host takeover or system compromise. In Red Hat environments, the affected package is not distributed in default Red Hat Enterprise Linux channels and is only available through community repositories such as EPEL. Workloads relying on this module are vulnerable only if external endpoints accept unvalidated percent-encoded null bytes that trigger parser mismatch across routing layers.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.18)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "http::parser::xs", "vendor": "perl"}], "created": "2026-10-30T13:45:15.111486+00:00", "updated": "2026-11-06T18:45:08.102419+00:00", "vendors": ["perl", "perl$PRODUCT$http::parser::xs"]}