UBUNTU-CVE-2026-116135: Medium severity ubuntu/libhttp-body-perl vulnerability
HTTP::Body versions before 1.2301 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them. The decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no entry and is replaced with nothing, joining the bytes on either side. Hex digits in percent escapes are case-insensitive, and conforming decoders return the byte. A remote attacker can send a field name or value that a conforming decoder in front of the application reads differently, so that pass%aBword reaches the application as password.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HTTP::Bodyto a version that resolves this vulnerability.Fixed in 1.23_01
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications using affected HTTP::Body versions to parse application/x-www-form-urlencoded request fields are exposed when another component, such as a proxy or gateway, decodes those fields according to standard case-insensitive percent-escape handling. The risk is a parsing discrepancy between that component and the application.
What does an attacker need to exploit it?
An attacker needs to be able to submit URL-encoded form field names or values containing mixed-case percent escapes, such as %aB. The attacker can use this to cause HTTP::Body to remove the escaped byte while a conforming decoder interprets it as the corresponding byte.
How can I tell whether an application is affected?
Check whether it uses HTTP::Body before version 1.23_01 and parses URL-encoded form data. Test a field containing a mixed-case escape, such as pass%aBword; an affected parser produces password rather than decoding %aB as a byte.