---
id: CVE-2026-116130
title: >-
  HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an
  encoded NUL byte in parse_http_request
summary: >-
  HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an
  encoded NUL byte in parse_http_request.


  The XS parser URL-decodes the request path and measures the result with
  strlen(), so PATH_INFO ends at the first byte decode…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-626
product: HTTP-Parser-XS
affected:
  - HTTP-Parser-XS < 0.18
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-06T16:40:33.779841Z'
published: '2026-10-30'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:41:08.545Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116130'
references:
  - url: >-
      https://github.com/kazuho/p5-http-parser-xs/commit/f388b9d7994722b01edd03d57de7d2fb819e1aae.patch
  - url: 'https://metacpan.org/release/KAZUHO/HTTP-Parser-XS-0.18/changes'
tags:
  - cve.org
epss: 0.00586
epssPercentile: 0.48236
ingestedAt: '2026-11-05T16:07:30.314Z'
---

## Overview

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.

The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.

## Affected

- `HTTP-Parser-XS < 0.18`

## Remediation

Upgrade to HTTP-Parser-XS 0.18 or later.