CVE-2026-114629: Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters
Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters.
Web::Dispatch::ParamParser::getunpackedbodyfrom reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation.
An attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Web::Simpleto a version that resolves this vulnerability.Fixed in 0.035 - Configuration
Configure MAX_BODY_SIZE in the application to cap the size of request bodies.
Web::Dispatch::ParamParser MAX_BODY_SIZE
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Web::Simple before 0.035 are exposed only on routes whose dispatch specification includes a % body-parameter match, such as a POST route matching %name=. The affected request body type is application/x-www-form-urlencoded.
What does an attacker need to do to trigger it?
No authentication is required. An attacker can send a request to an affected route with a very large declared Content-Length while sending a much smaller actual body, causing Perl to allocate based on the declared length.
Are default deployments necessarily affected?
Not necessarily. Exposure depends on whether the application defines a route with a % body-parameter match that accepts application/x-www-form-urlencoded input.
What can be done if upgrading is not immediately possible?
Restrict or reject requests with excessively large Content-Length values before they reach the application, particularly for affected form-urlencoded routes. This reduces the attacker-controlled allocation size.