CVE-2026-116130
説明
A flaw was found in HTTP::Parser::XS. When processing HTTP request paths, the parser URL-decodes the path and terminates the string at decoded null bytes rather than using the full path length. A remote attacker can exploit this flaw by sending a crafted path containing an encoded null byte (%00) to create a discrepancy between frontend security proxies and backend routing, potentially bypassing access control restrictions.
詳細
This vulnerability is rated as Moderate because exploitation requires a multi-tier web architecture where front-end filtering proxies disagree with backend request handling, limiting the flaw to authorization discrepancies rather than host takeover or system compromise. In Red Hat environments, the affected package is not distributed in default Red Hat Enterprise Linux channels and is only available through community repositories such as EPEL. Workloads relying on this module are vulnerable only if external endpoints accept unvalidated percent-encoded null bytes that trigger parser mismatch across routing layers.
脆弱性の原因 (CWE) の理解
Integrity
Technical Impact: Modify Application Data
Generally this error will cause the data structure to not work properly by truncating the data.
よくある質問
Not sure what something means? Check out our Security Glossary.
エラータ通知の受信を希望しますか? こちらで登録してください。
