HTTP-Parser-XS vulnerabilities

CVEs whose affected-version data names the HTTP-Parser-XS package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-116130Critical· 9.1

1w ago

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decode…

▾ MidnightEPSS 0.59%via CVEORG