Upstream information

CVE-2026-116130 at MITRE

Description

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.

The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

SUSE Bugzilla entry: 1289063 [NEW]

No SUSE Security Announcements cross referenced.

List of released packages

Product(s) Fixed package version(s) References
openSUSE Tumbleweed
  • perl-HTTP-Parser-XS >= 0.180.0-1.1
 Patchnames:
openSUSE-Tumbleweed-2026-12389

SUSE Timeline for this CVE

CVE page created: Mon Nov 2 14:52:56 2026
CVE page last modified: Tue Nov 3 12:57:54 2026