{"cve":"CVE-2026-116130","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"generic","value":"[0,0.18)"}}],"enrichment":{"confidence":100.0,"confidence_source":"manual","scores":[{"score":100.0,"source":"manual"}]},"product":"http::parser::xs","vendor":"perl"}],"created":"2026-10-30T13:45:15.111486+00:00","updated":"2026-11-04T14:00:09.560662+00:00","vendors":["perl","perl$PRODUCT$http::parser::xs"]},"epss":{"score":0.00329},"mitre":{"cpes":[],"created":"2026-10-30T12:38:27.038000+00:00","description":"HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.\n\nThe XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.\n\nA remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/116xxx/CVE-2026-116130.json","references":["https://github.com/kazuho/p5-http-parser-xs/commit/f388b9d7994722b01edd03d57de7d2fb819e1aae.patch","https://metacpan.org/release/KAZUHO/HTTP-Parser-XS-0.18/changes"],"title":"HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request","updated":"2026-10-30T15:05:28.040000+00:00","vendors":[],"weaknesses":["CWE-626"]},"nvd":{"cpes":[],"created":"2026-10-30T13:18:31.407000+00:00","description":"HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.\n\nThe XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.\n\nA remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-116130.json","references":["http://www.openwall.com/lists/oss-security/2026/10/30/12","https://github.com/kazuho/p5-http-parser-xs/commit/f388b9d7994722b01edd03d57de7d2fb819e1aae.patch","https://metacpan.org/release/KAZUHO/HTTP-Parser-XS-0.18/changes"],"title":null,"updated":"2026-10-30T19:39:14.897000+00:00","vendors":[],"weaknesses":["CWE-626"]},"opencve":{"changes":[{"created":"2026-10-30T12:45:00+00:00","data":[{"details":{"new":"HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.\n\nThe XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.\n\nA remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.","old":null},"type":"description"},{"details":{"new":"HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request","old":null},"type":"title"},{"details":{"added":["CWE-626"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://github.com/kazuho/p5-http-parser-xs/commit/f388b9d7994722b01edd03d57de7d2fb819e1aae.patch","https://metacpan.org/release/KAZUHO/HTTP-Parser-XS-0.18/changes"],"removed":[]},"type":"references"}],"id":"a3a08710-a4d8-4315-8a26-506a143919e9"},{"created":"2026-10-30T16:30:00+00:00","data":[{"details":{"added":["http://www.openwall.com/lists/oss-security/2026/10/30/12"],"removed":[]},"type":"references"}],"id":"a60031e9-57ec-4b59-94c9-b2d4ed8bff96"},{"created":"2026-10-30T23:15:00+00:00","data":[{"details":["perl","perl$PRODUCT$http::parser::xs"],"type":"first_time"},{"details":{"added":["perl","perl$PRODUCT$http::parser::xs"],"removed":[]},"type":"vendors"}],"id":"0085a709-e209-49ff-bf3d-60d6c0467d94"},{"created":"2026-11-04T12:15:00+00:00","data":[{"details":{"added":["CWE-464"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://nvd.nist.gov/vuln/detail/CVE-2026-116130","https://www.cve.org/CVERecord?id=CVE-2026-116130"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}},"removed":{},"updated":{"threat_severity":{"new":"Moderate","old":null}}},"type":"metrics"}],"id":"ce270b89-89f1-46cc-8ae6-911769caf74a"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2026-10-30T12:38:27+00:00","provider":"redhat"},"description":{"data":"HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.\n\nThe XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.\n\nA remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"provider":"redhat"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.00329},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":"Moderate","provider":"redhat"}},"references":{"data":["http://www.openwall.com/lists/oss-security/2026/10/30/12","https://github.com/kazuho/p5-http-parser-xs/commit/f388b9d7994722b01edd03d57de7d2fb819e1aae.patch","https://metacpan.org/release/KAZUHO/HTTP-Parser-XS-0.18/changes","https://nvd.nist.gov/vuln/detail/CVE-2026-116130","https://www.cve.org/CVERecord?id=CVE-2026-116130"],"providers":["mitre","nvd","redhat"]},"title":{"data":"HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request","provider":"mitre"},"updated":{"data":"2026-10-30T22:51:57.927075+00:00","provider":"enrichment"},"vendors":{"data":["perl","perl$PRODUCT$http::parser::xs"],"providers":["enrichment"]},"weaknesses":{"data":["CWE-464","CWE-626"],"providers":["mitre","nvd","redhat"]}},"redhat":{"cpes":[],"created":"2026-10-30T12:38:27+00:00","description":"HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.\nThe XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.\nA remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"threat_severity":"Moderate"},"redhat_repo_path":"2026/CVE-2026-116130.json","references":["https://github.com/kazuho/p5-http-parser-xs/commit/f388b9d7994722b01edd03d57de7d2fb819e1aae.patch","https://metacpan.org/release/KAZUHO/HTTP-Parser-XS-0.18/changes","https://nvd.nist.gov/vuln/detail/CVE-2026-116130","https://www.cve.org/CVERecord?id=CVE-2026-116130"],"title":"perl-http-parser-xs: HTTP::Parser::XS: Security control bypass via path truncation on encoded null bytes","updated":"2026-10-30T12:38:27+00:00","vendors":[],"weaknesses":["CWE-464"]}}