CVE-2026-116130

Critical

Description

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.

SeverityCritical

CVSS9.1

Exploit probability—

ProductHttp-parser-xs

PublishedOct 30, 2026

First seenNov 4, 2026

Weakness typeCWE-626CWE-626

How to fix

Update

HTTP-Parser-XS0.18 or later

Patches

github.com/kazuho/p5-http-parser-xs/commit/f388b9d7994722b01edd03d57de7d2fb819e1aae.patch

Vendor advisories

metacpan.org/release/KAZUHO/HTTP-Parser-XS-0.18/changes

Affected products

Product	Affected versions	Fixed in
HTTP-Parser-XS	v < 0.18	0.18

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.