CVE-2026-116130

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request

9.1 CriticalFix available

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.

The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: High

Exploit likelihood

0.59%Up 0.3 points since Oct 31, 2026

What each source reports

CVE List Score used 9.1

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.

The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.

Record: CVE-2026-116130
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-626
Updated: 2026-11-06

EUVDEUVD-2026-113904 9.1

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.

The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.

Record: EUVD-2026-113904
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated: 2026-11-06

GitHub AdvisoriesGHSA-qgp9-frp4-99qf 9.1

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in...

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.

The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.

Record: GHSA-qgp9-frp4-99qf
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-626
Updated: 2026-11-06

NVD 9.1

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.

The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.

Record: CVE-2026-116130
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-626
Updated: 2026-11-06

OSV 9.1

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.

The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.

Record: CVE-2026-116130
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-626
Updated: 2026-11-07

OSVDEBIAN-CVE-2026-116130 9.1

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.

Record: DEBIAN-CVE-2026-116130
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated: 2026-11-07

OSVopenSUSE-SU-2026:12389-1 No score

perl-HTTP-Parser-XS-0.180.0-1.1 on GA media

These are all security issues fixed in the perl-HTTP-Parser-XS-0.180.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:12389-1
Updated: 2026-11-03

OSVUBUNTU-CVE-2026-116130 No score

Record: UBUNTU-CVE-2026-116130
Updated: 2026-11-05

Affected packages

Affected packages
Package	Affected	Fixed
`libhttp-parser-xs-perl` Debian:12	All versions, plus listed versions 0.17-20.18-1	None known
`libhttp-parser-xs-perl` Debian:13	All versions, plus listed versions 0.17-20.18-1	None known
`libhttp-parser-xs-perl` Debian:14	before 0.18-1, plus listed versions 0.17-2	0.18-1
`libhttp-parser-xs-perl` Ubuntu:16.04:LTS	All versions, plus listed versions 0.17-10.17-1build1	None known
`libhttp-parser-xs-perl` Ubuntu:18.04:LTS	All versions, plus listed versions 0.17-1build3	None known
`libhttp-parser-xs-perl` Ubuntu:20.04:LTS	All versions, plus listed versions 0.17-1build40.17-1build5	None known
`libhttp-parser-xs-perl` Ubuntu:22.04:LTS	All versions, plus listed versions 0.17-20.17-2build1	None known
`libhttp-parser-xs-perl` Ubuntu:24.04:LTS	All versions, plus listed versions 0.17-2build20.17-2build30.17-2build40.17-2build5	None known
`libhttp-parser-xs-perl` Ubuntu:26.10	All versions, plus listed versions 0.17-2build60.17-2build7	None known
`libhttp-parser-xs-perl` Ubuntu:26.04:LTS	All versions, plus listed versions 0.17-2build6	None known
`perl-HTTP-Parser-XS` openSUSE:Tumbleweed	before 0.180.0-1.1	0.180.0-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	severity	CVE List, OSV
Nov 4, 2026	affected, aliases, references	OSV
Nov 3, 2026	affected, aliases, facts, references	OSV
Nov 3, 2026	affected, facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-116130 is a critical vulnerability (CVSS 9.1) in libhttp-parser-xs-perl, published October 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in libhttp-parser-xs-perl 0.18-1.

References

Show 7 moreShow less