Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation.
An attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to Web::Simple 0.035 or later, and in the application configure $Web::Dispatch::ParamParser::MAX_BODY_SIZE.
Vendor Workaround
For deployments that cannot upgrade but are running behind a reverse proxy, configure the proxy to reject requests above a maxiumum Content-Length.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sat, 24 Oct 2026 14:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation. An attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved. | |
| Title | Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters | |
| Weaknesses | CWE-789 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-24T16:06:39.380Z
Reserved: 2026-10-21T21:43:01.842Z
Link: CVE-2026-114629
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-24T14:16:39.187
Modified: 2026-10-24T14:16:39.187
Link: CVE-2026-114629
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-24T15:30:14Z