CVE-2026-116130— HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request
Quick assessment
Affected
CVE-2026-116130
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Perl 的 HTTP::Parser::XS 模块在 0.18 版本之前存在漏洞：在 函数中，若请求路径（PATH_INFO）包含经过编码的空字节（NUL byte），该函数会将其截断。 具体而言，XS 解析器会对请求路径进行 URL 解码，随后使用 函数测量解码后的结果长度。由于 在遇到第一个空字节（即 解码后的字节）时即终止，导致 被截断至该位置。纯 Perl 实现的后端不受此问题影响。 远程攻击者可构造包含此类路径的请求，使得代理服务器或安全过滤器基于完整路径进行检查，而目标应用程序却基于被截断后的较短路径
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationI. Basic Information for CVE-2026-116130
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request
Source: CVE Program / CVE List V5
Vulnerability Description
HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.
The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.
A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
空字节交互错误
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | - | 0 ~ 0.18 | - |
|
II. Public POCs for CVE-2026-116130
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-116130
请登录查看更多情报信息。