Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116135— HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them

Quick assessment

Affected
CVE-2026-116135
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Perl 的 HTTP::Body 模块 1.23_01 版本之前，存在一个安全漏洞：该模块在处理经过 URL 编码的表单字段时，会直接丢弃大小写混合的百分号转义序列（如 ），而不是对其进行解码。 其根本原因在于：解码表中仅收录了十六进制数对的全小写和全大写形式，而用于匹配转义序列的正则表达式却允许任意大小写组合。因此，当遇到类似 的混合大小写转义时，解码表无法找到对应条目，导致该转义序列被完全移除，其前后的字节直接拼接在一起。根据规范，十六进制数字在百分号转义中应不区分大小写，合规的解码器应将其还原为对应的字

AI Predicted 7.5 Difficulty: Easy

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 1.23_01 affected

I. Basic Information for CVE-2026-116135

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them
Source: CVE Program / CVE List V5
Vulnerability Description
HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them. The decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no entry and is replaced with nothing, joining the bytes on either side. Hex digits in percent escapes are case-insensitive, and conforming decoders return the byte. A remote attacker can send a field name or value that a conforming decoder in front of the application reads differently, so that pass%aBword reaches the application as password.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
大小写敏感处理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 1.23_01 -

II. Public POCs for CVE-2026-116135

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116135

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-116135 (1)

Vendor Pages for CVE-2026-116135 (1)

IV. Related Vulnerabilities

Same weakness: CWE-178