CVE-2026-116135

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116135", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-10-25T11:14:04.979Z", "datePublished": "2026-10-28T17:15:50.270Z", "dateUpdated": "2026-11-05T20:57:22.885Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["HTTP::Body"], "packageName": "HTTP-Body", "packageURL": "pkg:cpan/HTTP-Body", "programFiles": ["lib/HTTP/Body/UrlEncoded.pm"], "programRoutines": [{"name": "HTTP::Body::UrlEncoded::spin"}], "repo": "https://github.com/libwww-perl/HTTP-Body", "versions": [{"lessThan": "1.23_01", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them.\n\nThe decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no entry and is replaced with nothing, joining the bytes on either side. Hex digits in percent escapes are case-insensitive, and conforming decoders return the byte.\n\nA remote attacker can send a field name or value that a conforming decoder in front of the application reads differently, so that pass%aBword reaches the application as password."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-178", "description": "CWE-178 Improper Handling of Case Sensitivity", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-28T17:15:50.270Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/libwww-perl/HTTP-Body/commit/336f1a23b4115a5cbeb546f36df5af62c90bdc0d.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes"}, {"url": "https://www.rfc-editor.org/rfc/rfc3986#section-2.1"}], "solutions": [{"lang": "en", "value": "Upgrade to HTTP-Body 1.23_01 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T20:57:12.358183Z", "id": "CVE-2026-116135", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:57:22.885Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-116135", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-05T20:57:12.358183Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:57:04.162Z"}}], "cna": {"title": "HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/libwww-perl/HTTP-Body", "modules": ["HTTP::Body"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.23_01", "versionType": "custom"}], "packageURL": "pkg:cpan/HTTP-Body", "packageName": "HTTP-Body", "programFiles": ["lib/HTTP/Body/UrlEncoded.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "HTTP::Body::UrlEncoded::spin"}]}], "solutions": [{"lang": "en", "value": "Upgrade to HTTP-Body 1.23_01 or later."}], "references": [{"url": "https://github.com/libwww-perl/HTTP-Body/commit/336f1a23b4115a5cbeb546f36df5af62c90bdc0d.patch", "tags": ["patch"]}, {"url": "https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes", "tags": ["release-notes"]}, {"url": "https://www.rfc-editor.org/rfc/rfc3986#section-2.1"}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them.\n\nThe decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no entry and is replaced with nothing, joining the bytes on either side. Hex digits in percent escapes are case-insensitive, and conforming decoders return the byte.\n\nA remote attacker can send a field name or value that a conforming decoder in front of the application reads differently, so that pass%aBword reaches the application as password."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-178", "description": "CWE-178 Improper Handling of Case Sensitivity"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-28T17:15:50.270Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116135", "state": "PUBLISHED", "dateUpdated": "2026-11-05T20:57:22.885Z", "dateReserved": "2026-10-25T11:14:04.979Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-10-28T17:15:50.270Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["HTTP::Body"], "packageName": "HTTP-Body", "packageURL": "pkg:cpan/HTTP-Body", "programFiles": ["lib/HTTP/Body/UrlEncoded.pm"], "programRoutines": [{"name": "HTTP::Body::UrlEncoded::spin"}], "repo": "https://github.com/libwww-perl/HTTP-Body", "versions": [{"lessThan": "1.23_01", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them.\n\nThe decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no entry and is replaced with nothing, joining the bytes on either side. Hex digits in percent escapes are case-insensitive, and conforming decoders return the byte.\n\nA remote attacker can send a field name or value that a conforming decoder in front of the application reads differently, so that pass%aBword reaches the application as password."}], "id": "CVE-2026-116135", "lastModified": "2026-11-05T21:18:37.503", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116135", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T20:57:12.358183Z", "version": "2.0.3"}}]}, "published": "2026-10-28T18:17:12.683", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/libwww-perl/HTTP-Body/commit/336f1a23b4115a5cbeb546f36df5af62c90bdc0d.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://www.rfc-editor.org/rfc/rfc3986#section-2.1"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-178"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-http-body: HTTP::Body: Security filter bypass via improper handling of mixed-case percent-encoding", "id": "2563041", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563041"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-178", "details": ["HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them.\nThe decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no entry and is replaced with nothing, joining the bytes on either side. Hex digits in percent escapes are case-insensitive, and conforming decoders return the byte.\nA remote attacker can send a field name or value that a conforming decoder in front of the application reads differently, so that pass%aBword reaches the application as password.", "A flaw was found in HTTP::Body. When processing URL-encoded form submissions, the module removes mixed-case percent escapes instead of decoding them into their corresponding characters. A remote attacker can exploit this parsing discrepancy by submitting specially crafted requests, potentially bypassing upstream security filters or front-end controls that interpret the data differently from the backend application."], "name": "CVE-2026-116135", "public_date": "2026-10-28T17:15:50Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116135\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116135\nhttps://github.com/libwww-perl/HTTP-Body/commit/336f1a23b4115a5cbeb546f36df5af62c90bdc0d.patch\nhttps://metacpan.org/release/GETTY/HTTP-Body-1.24/changes\nhttps://www.rfc-editor.org/rfc/rfc3986#section-2.1"], "statement": "This vulnerability is rated as Moderate severity because, while exploitable remotely without authentication, it results in an encoding parsing discrepancy that can only be leveraged to bypass intermediate security filters or web application firewalls rather than causing direct system compromise or remote code execution. Furthermore, perl-HTTP-Body is not distributed in core Red Hat Enterprise Linux repositories and is only available through community channels such as EPEL. Exposure is restricted to custom Perl web applications that parse form submissions deployed behind front-end inspection layers with divergent decoding behaviors.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.23_01)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "http-body", "vendor": "libwww-perl"}], "created": "2026-10-28T19:00:23.217106+00:00", "updated": "2026-11-05T22:30:17.937169+00:00", "vendors": ["libwww-perl", "libwww-perl$PRODUCT$http-body"]}