Cyber ·
CVE-2026-65059: Furl up to version 3.15 allows memory exhaustion through unbounded decompression
Flaw disclosed on November 2, 2026 in Furl, a Perl HTTP client: up to version 3.15, decompressing HTTP responses without a limit can exhaust memory. The advisory was posted to the oss-sec list by the CPAN Security Group.
What the source states: CVE-2026-65059 affects Furl, the distribution of the same name, in all versions up to 3.15. According to the advisory, when HTTP responses are decompressed without a limit, the library can exhaust the process's available memory. The post was made by Robert Rothenberg on November 2, 2026, from the oss-sec list feed. The original page also lists the project repository and the MetaCPAN entry, which we do not reproduce here.
Why it matters: Furl is an HTTP client library. A system is exposed only if it uses that library, directly or through another dependency, to receive responses from untrusted or uncontrolled servers. Relevance to Rota Nacional: the platform does not patch third-party libraries and does not claim to block this kind of attack in a client's code. Its personal data detection acts on content sent to the models, not on memory consumed by an HTTP client.
How to protect the organization: first, check whether Furl appears in your projects' dependencies, including transitive ones, and at which version. If you are on an affected version, follow the original advisory and the maintainers' guidance on fixes, without assuming a fixed version that the source does not state. Meanwhile, limit the size of responses your code accepts and set timeouts. If your use of Rota goes through the OpenAI- or Anthropic-compatible API, keep your own keys out of code and review the logs in the dashboard.