Path Truncation Vulnerability in HTTP::Parser::XS by Kazuho
CVE-2026-116130
Currently unrated
What is CVE-2026-116130?
The HTTP::Parser::XS before version 0.18 in Perl contains a vulnerability where the parser truncates the PATH_INFO at the first instance of an encoded NUL byte (%00). This can allow a remote attacker to manipulate the requested path, potentially bypassing security filters that inspect the full path while the application operates on the truncated version. This issue primarily affects the XS implementation of the parser, with the pure-Perl backend remaining unaffected. This vulnerability underscores the critical need for developers to upgrade to the latest version to safeguard their applications.