Cyber ·
CVE-2026-116130: HTTP::Parser::XS before 0.18 truncates PATH_INFO at encoded NUL byte
Advisory from the CPAN Security Group on the HTTP-Parser-XS Perl distribution: versions before 0.18 truncate PATH_INFO when they encounter an encoded NUL byte in parse_http_request.
According to the advisory, published on October 30, 2026 in the oss-sec feed, the identifier is CVE-2026-116130 and it affects the HTTP-Parser-XS distribution for Perl in all versions before 0.18. The defect makes the library truncate the PATH_INFO value when it finds an encoded NUL byte while parsing an HTTP request, in the parse_http_request function. The available text is an automatic translation of the feed content, so check technical terms against the original source. The source does not describe exploitability or severity, and this summary does not add that information. To verify scope, consult the official vulnerability record using the CVE ID and the distribution page on MetaCPAN, which the advisory points to. Then identify in your Perl environments whether the installed version is below 0.18 and update the dependency where the fixed version is available. Rota Nacional does not fix third-party libraries and does not take part in HTTP parsing inside Perl applications, so this risk remains in your own infrastructure.