UBUNTU-CVE-2026-116130: Medium severity ubuntu/libhttp-parser-xs-perl vulnerability
HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen(), so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HTTP::Parser::XSto a version that resolves this vulnerability.Fixed in 0.18
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the XS backend of HTTP::Parser::XS before version 0.18 are affected. The pure-Perl backend is not affected.
What does an attacker need to exploit it?
An attacker needs to be able to send an HTTP request path containing an encoded NUL byte (%00). Exploitation depends on a proxy or filter evaluating the full path while the application routes using the truncated PATH_INFO value.
Are applications behind a proxy or request filter at particular risk?
Yes. The described security impact arises when an intermediary checks the complete request path but the application receives PATH_INFO truncated at the decoded NUL byte, potentially creating a mismatch in access-control or filtering decisions.