Applications using Web::Simple before version 0.035 are exposed when they have a route whose dispatch specification includes a % body-parameter match, such as sub (POST + %name=). The affected request handling applies to application/x-www-form-urlencoded bodies.
No authentication is required. An attacker needs to send a request to an affected route with a declared Content-Length much larger than the body actually sent.
Check whether the installed Web::Simple version is earlier than 0.035, then review dispatch specifications for routes with % body-parameter matches. Those routes can trigger the vulnerable body parsing behavior for urlencoded requests.
Upgrade Web::Simple to version 0.035 or later. The advisory identifies versions before 0.035 as affected.