Memory Exhaustion Vulnerability in Furl Perl Library by SYOHEX

CVE-2026-65059

What is CVE-2026-65059?

The Furl library, specifically versions up to 3.15, is susceptible to a memory exhaustion vulnerability due to unbounded decompression of compressed HTTP responses. It allows attackers to exploit this flaw by sending a small, compressed payload that, upon decompression, can expand excessively and consume all available memory. This results in a potential denial of service as the excessive memory allocation may terminate the process. The vulnerability can be triggered irrespective of whether the request specifies compression, and there is no limit set on the size of the decompressed output. Attack vectors include malicious servers or attackers exploiting unsecured HTTP connections.

References