{"id":"CVE-2026-8450","aliases":["ALSA-2026:36187","ALSA-2026:36188","ALSA-2026:36189","AZL-93024","DEBIAN-CVE-2026-8450","EUVD-2026-32050","GHSA-3hc6-3p33-wq57","MGASA-2026-0157","RHSA-2026:36187","RHSA-2026:36188","RHSA-2026:36189","RLSA-2026:36187","RLSA-2026:36188","RLSA-2026:36189","SUSE-SU-2026:22187-1","SUSE-SU-2026:2408-1","SUSE-SU-2026:2442-1","UBUNTU-CVE-2026-8450","USN-8419-1","openSUSE-SU-2026:10938-1","openSUSE-SU-2026:21119-1"],"status":"published","title":"HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()","description":"HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file().\n\nsend_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '\u003e path' and '\u003e\u003e path' open the path for write or append.\n\nUntrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.01398,"percentile":0.72636,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-73","CWE-78"],"published":"2026-05-27T04:22:26Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"perl-HTTP-Daemon","fixed_in":["6.12-6.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"perl-HTTP-Daemon","fixed_in":["6.01-24.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"perl-HTTP-Daemon","fixed_in":["6.16-7.el10_2.1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"perl-HTTP-Daemon","fixed_in":["6.16-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libhttp-daemon-perl","fixed_in":["6.16-1+deb13u1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libhttp-daemon-perl","fixed_in":["6.16-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libhttp-daemon-perl","fixed_in":["6.17-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"perl-HTTP-Daemon","fixed_in":["6.140.0-3.1.mga9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"perl-HTTP-Daemon","fixed_in":["0:6.12-6.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-HTTP-Daemon","fixed_in":["0:6.01-24.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"perl-HTTP-Daemon","fixed_in":["0:6.16-7.el10_2.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"perl-HTTP-Daemon","fixed_in":["0:6.12-6.el9_8.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"perl-HTTP-Daemon","fixed_in":["0:6.01-24.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"perl-HTTP-Daemon","fixed_in":["0:6.16-7.el10_2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"perl-HTTP-Daemon","fixed_in":["6.16-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"perl-HTTP-Daemon","fixed_in":["6.16-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"perl-HTTP-Daemon","fixed_in":["6.01-9.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"perl-HTTP-Daemon","fixed_in":["6.01-9.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"perl-HTTP-Daemon","fixed_in":["6.01-150000.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"perl-HTTP-Daemon","fixed_in":["6.01-150000.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"perl-HTTP-Daemon","fixed_in":["6.01-150000.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"perl-HTTP-Daemon","fixed_in":["6.01-150000.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"perl-HTTP-Daemon","fixed_in":["6.01-150000.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"perl-HTTP-Daemon","fixed_in":["6.01-150000.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"perl-HTTP-Daemon","fixed_in":["6.01-150000.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"perl-HTTP-Daemon","fixed_in":["6.01-150000.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"perl-HTTP-Daemon","fixed_in":["6.01-150000.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"perl-HTTP-Daemon","fixed_in":["6.01-150000.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"perl-HTTP-Daemon","fixed_in":["6.01-150000.3.8.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libhttp-daemon-perl","fixed_in":["6.01-1ubuntu0.14.04~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libhttp-daemon-perl","fixed_in":["6.01-1ubuntu0.16.04~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libhttp-daemon-perl","fixed_in":["6.01-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libhttp-daemon-perl","fixed_in":["6.06-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libhttp-daemon-perl","fixed_in":["6.13-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libhttp-daemon-perl","fixed_in":["6.16-1ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"libhttp-daemon-perl","fixed_in":["6.16-1ubuntu0.25.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libhttp-daemon-perl","fixed_in":["6.16-1ubuntu0.26.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-HTTP-Daemon","fixed_in":["6.170.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"perl-HTTP-Daemon","fixed_in":["6.16-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12-6.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.01-24.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16-7.el10_2.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libhttp-daemon-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16-1+deb13u1~deb12u1"}]}],"versions":["6.16-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libhttp-daemon-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16-1+deb13u1"}]}],"versions":["6.16-1","6.16-1+deb13u1~deb12u1"]},{"source":"osv","ecosystem":"Debian:14","package":"libhttp-daemon-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17-1"}]}],"versions":["6.16-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.140.0-3.1.mga9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.12-6.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.01-24.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16-7.el10_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.12-6.el9_8.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.01-24.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16-7.el10_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.01-9.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.01-9.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.01-150000.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.01-150000.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.01-150000.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.01-150000.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.01-150000.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.01-150000.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.01-150000.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.01-150000.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.01-150000.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.01-150000.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.01-150000.3.8.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libhttp-daemon-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.01-1ubuntu0.14.04~esm2"}]}],"versions":["6.01-1","6.01-1ubuntu0.14.04~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libhttp-daemon-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.01-1ubuntu0.16.04~esm2"}]}],"versions":["6.01-1","6.01-1ubuntu0.16.04~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libhttp-daemon-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.01-1ubuntu0.1+esm1"}]}],"versions":["6.01-1","6.01-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libhttp-daemon-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.06-1ubuntu0.1+esm1"}]}],"versions":["6.04-1","6.06-1","6.06-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libhttp-daemon-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13-1ubuntu0.2"}]}],"versions":["6.12-1","6.13-1","6.13-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libhttp-daemon-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16-1ubuntu0.24.04.1"}]}],"versions":["6.16-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libhttp-daemon-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16-1ubuntu0.25.10.1"}]}],"versions":["6.16-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libhttp-daemon-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16-1ubuntu0.26.04.1"}]}],"versions":["6.16-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libhttp-daemon-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.01-1ubuntu0.14.04~esm2"}]}],"versions":["6.01-1","6.01-1ubuntu0.14.04~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libhttp-daemon-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.01-1ubuntu0.16.04~esm2"}]}],"versions":["6.01-1","6.01-1ubuntu0.16.04~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libhttp-daemon-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.01-1ubuntu0.1+esm1"}]}],"versions":["6.01-1","6.01-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libhttp-daemon-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.06-1ubuntu0.1+esm1"}]}],"versions":["6.04-1","6.06-1","6.06-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libhttp-daemon-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13-1ubuntu0.2"}]}],"versions":["6.12-1","6.13-1","6.13-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libhttp-daemon-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16-1ubuntu0.24.04.1"}]}],"versions":["6.16-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libhttp-daemon-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16-1ubuntu0.25.10.1"}]}],"versions":["6.16-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libhttp-daemon-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16-1ubuntu0.26.04.1"}]}],"versions":["6.16-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.170.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-HTTP-Daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16-160000.3.1"}]}]}],"products":[{"vendor":"oalders","product":"http::daemon"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://github.com/libwww-perl/HTTP-Daemon/pull/89","tags":["issue-tracking","report","article"]},{"url":"https://github.com/libwww-perl/HTTP-Daemon/commit/945d35141d94490f749640bd4390acd6a2193995.patch","tags":["patch","fix","article"]},{"url":"https://metacpan.org/release/OALDERS/HTTP-Daemon-6.17/changes","tags":["release-notes","advisory","web","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/27/5","tags":["web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/06/msg00028.html","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8450","tags":["vdb-entry","x_refsource_REDHAT","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481773","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8450.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36189","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36188","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36187","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8450","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-3hc6-3p33-wq57"},{"url":"https://bugzilla.redhat.com/2481773","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-36187.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-36188.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-36189.html","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8450.json","tags":["advisory"]},{"url":"https://github.com/libwww-perl/HTTP-Daemon","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-8450","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0157.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35594","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/27/5","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36187.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8450","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36188.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36189.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:36187","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:36188","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:36189","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622187-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266370","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8450","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262408-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262442-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-8450","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/40435207/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8419-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-8450","title":"HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()","description":"HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file().\n\nsend_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '\u003e path' and '\u003e\u003e path' open the path for write or append.\n\nUntrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.","status":"published","published":"2026-05-27T04:22:26.539Z","modified":"2026-07-15T00:39:17.237Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-78","CWE-73","CWE-78"],"updated_at":"2026-11-02T13:48:02.226896Z"}],"euvd":[{"id":"EUVD-2026-32050","description":"HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file().\n\nsend_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '\u003e path' and '\u003e\u003e path' open the path for write or append.\n\nUntrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.","status":"published","published":"2026-05-27T04:22:26Z","modified":"2026-07-15T00:39:17Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T18:19:56.918546Z"}],"ghsa":[{"id":"GHSA-3hc6-3p33-wq57","title":"HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file().\n\nsend_file...","description":"HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file().\n\nsend_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '\u003e path' and '\u003e\u003e path' open the path for write or append.\n\nUntrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.","status":"published","published":"2026-05-27T06:31:34Z","modified":"2026-07-07T12:31:30Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-73","CWE-78"],"updated_at":"2026-11-02T15:09:18.163038Z"}],"nvd":[{"id":"CVE-2026-8450","description":"HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file().\n\nsend_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '\u003e path' and '\u003e\u003e path' open the path for write or append.\n\nUntrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.","status":"published","published":"2026-05-27T05:16:23.067Z","modified":"2026-07-23T11:10:00.12Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-73","CWE-78"],"updated_at":"2026-11-02T14:12:20.511562Z"}],"osv":[{"id":"CVE-2026-8450","title":"HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()","description":"HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file().\n\nsend_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '\u003e path' and '\u003e\u003e path' open the path for write or append.\n\nUntrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.","status":"published","published":"2026-05-27T04:22:26.539Z","modified":"2026-10-28T02:30:51.968390394Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-73","CWE-78"],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"DEBIAN-CVE-2026-8450","description":"HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file().  send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '\u003e path' and '\u003e\u003e path' open the path for write or append.  Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.","status":"published","published":"2026-05-27T05:16:23.067Z","modified":"2026-10-01T03:03:51.797581107Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"RHSA-2026:36187","title":"Red Hat Security Advisory: perl-HTTP-Daemon security update","status":"published","published":"2026-07-07T10:09:41Z","modified":"2026-07-08T10:09:09Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:36188","title":"Red Hat Security Advisory: perl-HTTP-Daemon security update","status":"published","published":"2026-07-08T10:09:10Z","modified":"2026-07-08T10:30:58.712031892Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:36189","title":"Red Hat Security Advisory: perl-HTTP-Daemon security update","status":"published","published":"2026-07-08T10:09:10Z","modified":"2026-07-08T10:30:16.454762304Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RLSA-2026:36187","title":"Important: perl-HTTP-Daemon security update","description":"The perl-HTTP-Daemon package includes the HTTP::Daemon class, a subclass of IO::Socket::IP. Instances of the HTTP::Daemon class are HTTP/1.1 servers that listen on a socket for incoming requests.\n\nSecurity Fix(es):\n\n* perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in send_file() (CVE-2026-8450)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-08T12:04:06.378376Z","modified":"2026-07-08T12:30:05.78798501Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:36188","title":"Important: perl-HTTP-Daemon security update","description":"The perl-HTTP-Daemon package includes the HTTP::Daemon class, a subclass of IO::Socket::IP. Instances of the HTTP::Daemon class are HTTP/1.1 servers that listen on a socket for incoming requests.\n\nSecurity Fix(es):\n\n* perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in send_file() (CVE-2026-8450)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-08T06:00:40.121543Z","modified":"2026-07-08T18:26:00.669800607Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:36189","title":"Important: perl-HTTP-Daemon security update","description":"The perl-HTTP-Daemon package includes the HTTP::Daemon class, a subclass of IO::Socket::IP. Instances of the HTTP::Daemon class are HTTP/1.1 servers that listen on a socket for incoming requests.\n\nSecurity Fix(es):\n\n* perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in send_file() (CVE-2026-8450)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-08T12:06:34.177947Z","modified":"2026-07-08T12:30:04.336429672Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"UBUNTU-CVE-2026-8450","description":"HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '\u003e path' and '\u003e\u003e path' open the path for write or append. Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.","status":"published","published":"2026-05-27T05:16:00Z","modified":"2026-06-30T18:18:14.396103639Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"ALSA-2026:36187","title":"Important: perl-HTTP-Daemon security update","description":"The perl-HTTP-Daemon package includes the [HTTP::Daemon](HTTP::Daemon) class, a subclass of IO::Socket::IP. Instances of the [HTTP::Daemon](HTTP::Daemon) class are HTTP/1.1 servers that listen on a socket for incoming requests.  \n\nSecurity Fix(es):  \n\n  * perl-HTTP-Daemon: [HTTP::Daemon:](HTTP::Daemon:) Arbitrary code execution via OS command injection in send_file() (CVE-2026-8450)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-07T00:00:00Z","modified":"2026-10-29T11:32:35.39232757Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:36188","title":"Important: perl-HTTP-Daemon security update","description":"The perl-HTTP-Daemon package includes the [HTTP::Daemon](HTTP::Daemon) class, a subclass of IO::Socket::IP. Instances of the [HTTP::Daemon](HTTP::Daemon) class are HTTP/1.1 servers that listen on a socket for incoming requests.  \n\nSecurity Fix(es):  \n\n  * perl-HTTP-Daemon: [HTTP::Daemon:](HTTP::Daemon:) Arbitrary code execution via OS command injection in send_file() (CVE-2026-8450)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-07T00:00:00Z","modified":"2026-10-29T11:02:24.183538368Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:36189","title":"Important: perl-HTTP-Daemon security update","description":"The perl-HTTP-Daemon package includes the [HTTP::Daemon](HTTP::Daemon) class, a subclass of IO::Socket::IP. Instances of the [HTTP::Daemon](HTTP::Daemon) class are HTTP/1.1 servers that listen on a socket for incoming requests.  \n\nSecurity Fix(es):  \n\n  * perl-HTTP-Daemon: [HTTP::Daemon:](HTTP::Daemon:) Arbitrary code execution via OS command injection in send_file() (CVE-2026-8450)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-07T00:00:00Z","modified":"2026-10-29T11:30:31.078669345Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"AZL-93024","title":"CVE-2026-8450 affecting package perl-HTTP-Daemon for versions less than 6.16-2","description":"HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file().\n\nsend_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '\u003e path' and '\u003e\u003e path' open the path for write or append.\n\nUntrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.","status":"published","published":"2026-05-27T05:16:23Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.880689Z"},{"id":"MGASA-2026-0157","title":"Updated perl-HTTP-Daemon package fixes a security vulnerability","description":"The updated package fixes a security vulnerability:\nHTTP::Daemon versions before 6.17 for Perl allow OS command injection\nvia send_file(). (CVE-2026-8450)\n","status":"published","published":"2026-05-29T05:12:50Z","modified":"2026-05-29T05:15:04.54787131Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10938-1","title":"perl-HTTP-Daemon-6.170.0-1.1 on GA media","description":"These are all security issues fixed in the perl-HTTP-Daemon-6.170.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-02T00:00:00Z","modified":"2026-06-03T08:30:21.407677495Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21119-1","title":"Security update for perl-HTTP-Daemon","description":"This update for perl-HTTP-Daemon fixes the following issue\n\n- CVE-2026-8450: HTTP: Daemon versions before 6.17 for Perl allow OS command injection via send_file() (bsc#1266370).\n","status":"published","published":"2026-06-20T06:49:47Z","modified":"2026-06-30T18:24:43.157641185Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22187-1","title":"Security update for perl-HTTP-Daemon","description":"This update for perl-HTTP-Daemon fixes the following issue\n\n- CVE-2026-8450: HTTP: Daemon versions before 6.17 for Perl allow OS command injection via send_file() (bsc#1266370).\n","status":"published","published":"2026-06-20T06:49:45Z","modified":"2026-06-24T09:00:06.595385255Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2408-1","title":"Security update for perl-HTTP-Daemon","description":"This update for perl-HTTP-Daemon fixes the following issues:\n\n- CVE-2026-8450: Fixed OS command injection via send_file() (bsc#1266370).\n","status":"published","published":"2026-06-16T07:57:02Z","modified":"2026-06-17T09:15:05.406995204Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:2442-1","title":"Security update for perl-HTTP-Daemon","description":"This update for perl-HTTP-Daemon fixes the following issues:\n\n- CVE-2026-8450: Fixed OS command injection via send_file() (bsc#1266370).\n","status":"published","published":"2026-06-18T07:24:12Z","modified":"2026-06-19T08:15:05.71446494Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"USN-8419-1","title":"libhttp-daemon-perl vulnerability","description":"It was discovered that HTTP-Daemon incorrectly handled untrusted input\nunder certain circumstances. A remote attacker could possibly use this\nissue to execute arbitrary commands, create or overwrite arbitrary files,\nor expose sensitive information.","status":"published","published":"2026-06-10T13:49:41Z","modified":"2026-06-30T18:17:25.43541568Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}