{"id":"DEBIAN-CVE-2026-116130","details":"HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.  The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.  A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.","modified":"2026-10-31T06:00:06.292049374Z","published":"2026-10-30T13:18:31.407Z","upstream":["CVE-2026-116130"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-116130"}],"affected":[{"package":{"name":"libhttp-parser-xs-perl","ecosystem":"Debian:12","purl":"pkg:deb/debian/libhttp-parser-xs-perl?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17-2","0.18-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-116130.json"}},{"package":{"name":"libhttp-parser-xs-perl","ecosystem":"Debian:13","purl":"pkg:deb/debian/libhttp-parser-xs-perl?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17-2","0.18-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-116130.json"}},{"package":{"name":"libhttp-parser-xs-perl","ecosystem":"Debian:14","purl":"pkg:deb/debian/libhttp-parser-xs-perl?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17-2","0.18-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-116130.json"}}],"schema_version":"1.9.2"}