CVE-2026-114629
Description
A flaw was found in Web::Simple. When parsing URL-encoded request bodies, the application allocates memory buffers based directly on the declared Content-Length header without enforcing a size limit. An unauthenticated remote attacker can exploit this flaw by sending a request with an excessively large Content-Length value, leading to severe memory exhaustion and a Denial of Service (DoS).
Statement
This flaw is rated as Important severity because unauthenticated remote clients can trigger rapid out-of-memory crashes on exposed web servers without requiring substantial network bandwidth or computational effort. In Red Hat environments, the vulnerability affects deployments utilizing Web::Simple to route and process HTTP POST submissions with parameterized form data. Because the memory allocation occurs prior to receiving the complete payload, single malicious requests can exhaust host memory and disrupt concurrent services running on the system.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
