CVE-2026-116135
Description
A flaw was found in HTTP::Body. When processing URL-encoded form submissions, the module removes mixed-case percent escapes instead of decoding them into their corresponding characters. A remote attacker can exploit this parsing discrepancy by submitting specially crafted requests, potentially bypassing upstream security filters or front-end controls that interpret the data differently from the backend application.
Statement
This vulnerability is rated as Moderate severity because, while exploitable remotely without authentication, it results in an encoding parsing discrepancy that can only be leveraged to bypass intermediate security filters or web application firewalls rather than causing direct system compromise or remote code execution. Furthermore, perl-HTTP-Body is not distributed in core Red Hat Enterprise Linux repositories and is only available through community channels such as EPEL. Exposure is restricted to custom Perl web applications that parse form submissions deployed behind front-end inspection layers with divergent decoding behaviors.
Mitigation
Upgrade HTTP::Body to 1.23_01/1.24 or later. Interim mitigation: normalize or reject mixed-case percent escapes at the front-end inspection layer so decoding matches the application.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Improperly handled case sensitive data can lead to several possible consequences, including: - case-insensitive passwords reducing the size of the key space, making brute force attacks easier - bypassing filters or access controls using alternate names - multiple interpretation errors using alternate names.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
