CVE-2026-65059
Furl versions before 3.16 for Perl allow memory exhaustion via unbounded decompression of HTTP responses
Published Nov 2, 2026
CVSS 3.1 · 7.5 High
EPSS < 1%
KEV · Not listed
Description
Furl versions before 3.16 for Perl allow memory exhaustion via unbounded decompression of HTTP responses.
Furl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string with no size limit. It does this whether or not the request asked for compression, and no option caps the decompressed size. Responses read with write_file or write_code are streamed rather than held in memory.
A malicious server, or an attacker on a plain HTTP connection, can send a small compressed response that expands to exhaust the client's memory and end the process.
Furl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string with no size limit. It does this whether or not the request asked for compression, and no option caps the decompressed size. Responses read with write_file or write_code are streamed rather than held in memory.
A malicious server, or an attacker on a plain HTTP connection, can send a small compressed response that expands to exhaust the client's memory and end the process.
Affected Products
-
CVE record
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
| Vendor | Product | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Tokuhirom | Furl |
|
Remediation
Vendor Solution
Upgrade to version 3.16 or later.
Tracking
Advisories
Metrics
No CVSS v4.0
Attack Vector Network
Attack Complexity Low
Privileges Required None
Scope Unchanged
Confidentiality Impact None
Integrity Impact None
Availability Impact High
User Interaction None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.516% probability within 30 days)
Exploitation none
Automatable yes
Technical Impact partial
References
History
Nov 10, 2026 8:00 AM
Description updated. Title updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses. Furl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string with no size limit. It does this whether or not the request asked for compression, and no option caps the decompressed size. Responses read with write_file or write_code are streamed rather than held in memory. A malicious server, or an attacker on a plain HTTP connection, can send a small compressed response that expands to exhaust the client's memory and end the process. | Furl versions before 3.16 for Perl allow memory exhaustion via unbounded decompression of HTTP responses. Furl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string with no size limit. It does this whether or not the request asked for compression, and no option caps the decompressed size. Responses read with write_file or write_code are streamed rather than held in memory. A malicious server, or an attacker on a plain HTTP connection, can send a small compressed response that expands to exhaust the client's memory and end the process. |
| Title | Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses | Furl versions before 3.16 for Perl allow memory exhaustion via unbounded decompression of HTTP responses |
| References |
|
Nov 7, 2026 7:30 AM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Nov 6, 2026 7:30 PM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Nov 3, 2026 5:00 PM
First appearance in the feed. Affected vendors updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Tokuhirom
Tokuhirom furl |
|
| Vendors & Products |
Tokuhirom
Tokuhirom furl |
Nov 2, 2026 8:30 PM
Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Nov 2, 2026 5:15 PM
Description updated. Title updated. Weaknesses updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses. Furl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string with no size limit. It does this whether or not the request asked for compression, and no option caps the decompressed size. Responses read with write_file or write_code are streamed rather than held in memory. A malicious server, or an attacker on a plain HTTP connection, can send a small compressed response that expands to exhaust the client's memory and end the process. | |
| Title | Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses | |
| Weaknesses | CWE-409 | |
| References |
|
Weaknesses
