Bug#1152633: libhttp-parser-xs-perl: CVE-2026-116130

[Salvatore Bonaccorso]

Source: libhttp-parser-xs-perl
Version: 0.17-2
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for libhttp-parser-xs-perl.

CVE-2026-116130[0]:
| HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at
| an encoded NUL byte in parse_http_request.  The XS parser URL-
| decodes the request path and measures the result with strlen(), so
| PATH_INFO ends at the first byte decoded from %00. The pure-Perl
| backend is not affected.  A remote attacker can send a path that a
| proxy or filter checks in full while the application routes on a
| shorter one.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-116130
    https://www.cve.org/CVERecord?id=CVE-2026-116130
[1] https://lists.security.metacpan.org/cve-announce/msg/44760361/
[2]  https://github.com/kazuho/p5-http-parser-xs/commit/f388b9d7994722b01edd03d57de7d2fb819e1aae

Regards,
Salvatore