CVE-2026-116135: HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them
HTTP::Body versions before 1.2301 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them.
The decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no entry and is replaced with nothing, joining the bytes on either side. Hex digits in percent escapes are case-insensitive, and conforming decoders return the byte.
A remote attacker can send a field name or value that a conforming decoder in front of the application reads differently, so that pass%aBword reaches the application as password.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HTTP::Bodyto a version that resolves this vulnerability.Fixed in 1.23_01
Event History
Frequently Asked Questions
What deployment pattern is exposed to request-parsing discrepancies?
Deployments are exposed when a conforming decoder in front of the application interprets URL-encoded form fields differently from HTTP::Body. A mixed-case escape can be decoded by the front-end while HTTP::Body removes it, causing the application to receive a different field name or value.
What must an attacker send to trigger the issue?
The attacker must be able to submit URL-encoded form data containing a percent escape whose two hexadecimal digits use mixed case, such as %aB. HTTP::Body can remove that escape and join the surrounding bytes, so pass%aBword can arrive at the application as password.
Which versions require remediation?
HTTP::Body versions before 1.23_01 are affected. The referenced changes are published with HTTP-Body 1.24.