CVE-2026-114629
Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation. An attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.
- Score
- –
- Published
- 2026-10-24
- Links
- NVD · cve.org · Report wrong data
Matched ports (1)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| www/p5-Web-Simple | p5-Web-Simple | 0.033 | unaddressed | sunpoet@FreeBSD.org |
Template for a VuXML entry
Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>p5-Web-Simple</name>
<range><lt>0.035</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Web::Simple versions before 0.035 for Perl allocate a buffer sized by
the Content-Length header for urlencoded body
parameters.
Web::Dispatch::ParamParser::get_unpacked_body_from reads
an application/x-www-form-urlencoded body using a single read call,
with no cap and the return value ignored. Perl's read grows the buffer
to the requested length before reading, so the declared Content-Length
determines the allocation.
An attacker can trigger this through any
route whose dispatch specification has a % body-parameter match, such
as sub (POST + %name=), sending a Content-Length far larger than the
body actually sent. No authentication is involved.</p>
</body>
</description>
<references>
<cvename>CVE-2026-114629</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-114629</url>
</references>
<dates>
<discovery>2026-10-24</discovery>
<entry>2026-10-26</entry>
</dates>
</vuln>