Encoding Vulnerability in HTTP::Body for Perl Product

CVE-2026-116135

What is CVE-2026-116135?

A vulnerability has been identified in the HTTP::Body module for Perl, where versions prior to 1.23_01 improperly handle mixed-case percent escapes in urlencoded form fields. The issue stems from the decoder's limited lookup table, which only recognizes lowercase and uppercase hexadecimal pairs, leading to garbled data for mixed-case inputs. Consequently, a remote attacker can exploit this flaw by crafting a malicious field name or value that is processed differently by compliant decoders. This allows an attacker to manipulate the transmitted data, potentially leading to unintended consequences within the application.

References