CVE-2026-116130

Name	CVE-2026-116130
Description	HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1152633

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libhttp-parser-xs-perl (PTS)	bookworm, forky, trixie	0.17-2	vulnerable
	sid	0.18-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libhttp-parser-xs-perl	source	(unstable)	0.18-1			1152633

Notes

https://lists.security.metacpan.org/cve-announce/msg/44760361/
Fixed by: https://github.com/kazuho/p5-http-parser-xs/commit/f388b9d7994722b01edd03d57de7d2fb819e1aae (0.18)