Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-65059— Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses

Quick assessment

Affected
CVE-2026-65059
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 Furl 模块（3.15 及更早版本）存在内存耗尽漏洞：攻击者可利用其无限制的 HTTP 响应解压缩功能触发该问题。 Furl 会对带有 gzip、x-gzip 或 deflate 内容编码（Content-Encoding）的响应体进行解压缩（inflate），并将解压后的输出无限制地追加到响应字符串中。无论客户端请求是否要求压缩，该行为均会执行，且没有任何选项用于限制解压后内容的大小。不过，通过 或 方法读取的响应是以流式方式处理的，不会全部驻留于内存中。 恶意服务器或处于明文 HTTP 连接中的

AI Predicted 7.5 Difficulty: Easy

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None ≤ 3.15 affected

I. Basic Information for CVE-2026-65059

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses
Source: CVE Program / CVE List V5
Vulnerability Description
Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses. Furl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string with no size limit. It does this whether or not the request asked for compression, and no option caps the decompressed size. Responses read with write_file or write_code are streamed rather than held in memory. A malicious server, or an attacker on a plain HTTP connection, can send a small compressed response that expands to exhaust the client's memory and end the process.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 3.15 -

II. Public POCs for CVE-2026-65059

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-65059

请登录查看更多情报信息。

Other References for CVE-2026-65059 (2)

IV. Related Vulnerabilities

Same weakness: CWE-409