Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114629— Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters

Quick assessment

Affected
CVE-2026-114629
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 Web::Simple 在 0.035 版本之前存在漏洞：当处理 URL 编码的请求体参数时，该模块会根据 HTTP 请求头中的 Content-Length 字段来分配缓冲区。 具体而言，Web::Dispatch::ParamParser 中的 get_unpacked_body_from 函数在读取 application/x-www-form-urlencoded 类型的请求体时，仅使用一次 read 调用，且未对读取长度进行限制，同时忽略了该函数的返回值。由于 Perl 的 read 函数会

AI Predicted 9.8 Difficulty: Trivial

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 0.035 affected

I. Basic Information for CVE-2026-114629

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters
Source: CVE Program / CVE List V5
Vulnerability Description
Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation. An attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的内存分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 0.035 -

II. Public POCs for CVE-2026-114629

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114629

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-114629 (1)

IV. Related Vulnerabilities

Same weakness: CWE-789