SZB-4bbea8867d
HTTP::Parser::XS truncates request paths at encoded NUL bytes (EUVD-2026-113904)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- HTTP::Parser::XS
- Product
- HTTP::Parser::XS
- First seen
Summary
The EUVD entry, as relayed on Mastodon, says HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte, while the pure-Perl backend is not affected. The item does not list a score, and its description of the remote attacker's impact is cut off.
If you use HTTP::Parser::XS
Upgrade HTTP::Parser::XS to version 0.18 or later.
Switch to the pure-Perl backend as an interim workaround if upgrading is delayed.
What the sources say 1
· Mastodon: “HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.” Source