Bug#1151935: libweb-simple-perl: CVE-2026-114629

[Salvatore Bonaccorso]

Source: libweb-simple-perl
Version: 0.033-2
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for libweb-simple-perl.

CVE-2026-114629[0]:
| Web::Simple versions before 0.035 for Perl allocate a buffer sized
| by the Content-Length header for urlencoded body parameters.
| Web::Dispatch::ParamParser::get_unpacked_body_from reads an
| application/x-www-form-urlencoded body using a single read call,
| with no cap and the return value ignored. Perl's read grows the
| buffer to the requested length before reading, so the declared
| Content-Length determines the allocation.  An attacker can trigger
| this through any route whose dispatch specification has a % body-
| parameter match, such as sub (POST + %name=), sending a Content-
| Length far larger than the body actually sent. No authentication is
| involved.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-114629
    https://www.cve.org/CVERecord?id=CVE-2026-114629
[1] https://lists.security.metacpan.org/cve-announce/msg/44599125/

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore