DEBIAN-CVE-2026-116130: Debian/libhttp-parser-xs-perl vulnerability

Q: Which deployments are exposed to this issue?

Deployments using HTTP::Parser::XS before version 0.18 are affected when they use its XS parser. The pure-Perl backend is not affected.

Q: What must an attacker be able to do to exploit it?

An attacker needs to be able to send an HTTP request containing an encoded NUL byte (%00) in the request path. Exploitation is relevant where a proxy or filter evaluates the full path but the application routes using PATH_INFO produced by the affected parser.

Q: How can I determine whether a deployment is affected?

Check whether the deployment uses HTTP::Parser::XS before 0.18 and whether requests are processed by the XS parser rather than the pure-Perl backend. Also identify proxy, filtering, or routing controls that may interpret encoded-NUL paths differently from the application.

Published Oct 30, 2026

Updated

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen(), so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.

Affected Software

3 affected componentsFixes available

debian/libhttp-parser-xs-perl*

debian/libhttp-parser-xs-perl<0.18-1

0.18-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/libhttp-parser-xs-perl to a version that resolves this vulnerability.
Fixed in 0.18-1
Upgrade
Upgrade HTTP::Parser::XS to a version that resolves this vulnerability.
Fixed in 0.18

Event History

Oct 30, 2026

CVE Published

via OSV·01:18 PM

Data Sourced

via OSV·01:18 PM

DescriptionAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using HTTP::Parser::XS before version 0.18 are affected when they use its XS parser. The pure-Perl backend is not affected.

What must an attacker be able to do to exploit it?

An attacker needs to be able to send an HTTP request containing an encoded NUL byte (%00) in the request path. Exploitation is relevant where a proxy or filter evaluates the full path but the application routes using PATH_INFO produced by the affected parser.

How can I determine whether a deployment is affected?

Check whether the deployment uses HTTP::Parser::XS before 0.18 and whether requests are processed by the XS parser rather than the pure-Perl backend. Also identify proxy, filtering, or routing controls that may interpret encoded-NUL paths differently from the application.

DEBIAN-CVE-2026-116130: Debian/libhttp-parser-xs-perl vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to exploit it?

How can I determine whether a deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to exploit it?

How can I determine whether a deployment is affected?