CVE-2026-114629

Full vulnerability record from the local CVENow database.

Description

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation. An attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Awaiting Analysis

Source identifier

9b29abf9-4ab0-4765-b253-1875cd9b441e

Published

2026-10-24 14:16:39.187000

Last modified

2026-10-26 18:39:42.503000

View original CVE JSON

{
  "id": "CVE-2026-114629",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-10-24T14:16:39.187",
  "lastModified": "2026-10-26T18:39:42.503",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters.\n\nWeb::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation.\n\nAn attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "Web-Simple",
          "modules": [
            "Web::Simple"
          ],
          "programFiles": [
            "lib/Web/Dispatch/ParamParser.pm"
          ],
          "programRoutines": [
            {
              "name": "Web::Dispatch::ParamParser::get_unpacked_body_from"
            }
          ],
          "repo": "https://github.com/p5sagit/Web-Simple",
          "packageURL": "pkg:cpan/Web-Simple",
          "versions": [
            {
              "version": "0",
              "lessThan": "0.035",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-789"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/p5sagit/Web-Simple/commit/7e02c4f6204a2898938d357e6efe6dc2679af695.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/ETHER/Web-Simple-0.035/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/10/24/4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}