Buffer Allocation Vulnerability in Web::Simple for Perl by ETHER
CVE-2026-114629
What is CVE-2026-114629?
The Web::Simple module for Perl, specifically in versions prior to 0.035, exhibits a vulnerability that leads to improper buffer allocation based on the Content-Length header for urlencoded body parameters. The method Web::Dispatch::ParamParser::get_unpacked_body_from is susceptible to exploitation as it reads application/x-www-form-urlencoded data without capping the size of the buffer allocated. An attacker can exploit this by sending a Content-Length that significantly exceeds the actual size of the body sent, potentially overrunning the allocated buffer. This flaw allows attackers to craft requests without needing authentication, posing a risk to the integrity and stability of applications utilizing this library. It is crucial for users of affected versions to update to 0.035 or later to mitigate this vulnerability.