{"schema_version":"2","view":"grouped","data":[{"id":56339,"cve_ids":["CVE-2026-114629"],"payload":{"kind":"advisory","title":"Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters","summary":"Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation. An attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.","evidence":"cve:CVE-2026-114629","products":[],"severity":"unknown","structured":{"id":"CVE-2026-114629","aliases":["CVE-2026-114629"],"metrics":[],"affected":[{"repo":"https://github.com/p5sagit/Web-Simple","modules":["Web::Simple"],"versions":[{"status":"affected","version":"0","lessThan":"0.035","versionType":"custom"}],"packageURL":"pkg:cpan/Web-Simple","packageName":"Web-Simple","programFiles":["lib/Web/Dispatch/ParamParser.pm"],"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","programRoutines":[{"name":"Web::Dispatch::ParamParser::get_unpacked_body_from"}]}],"modified":"2026-10-24T16:06:39.380Z","provider":"cve","references":["https://github.com/p5sagit/Web-Simple/commit/7e02c4f6204a2898938d357e6efe6dc2679af695.patch","https://metacpan.org/release/ETHER/Web-Simple-0.035/changes"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/24/4"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-24T16:06:39.380Z"}}],"cna":{"orgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","shortName":"CPANSec","dateUpdated":"2026-10-24T13:50:47.616Z"}}},"related_cves":[{"value":"CVE-2026-114629","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b1143c42-d2b0-4bac-9cc0-49a8411dbb5e","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114629","advisory_id":"b1143c42-d2b0-4bac-9cc0-49a8411dbb5e","event_types":["advisory"],"published_at":"2026-10-25T16:13:03.566801+00:00","technologies":["core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T13:50:47.616+00:00","detail_url":"/advisories/advisory%3Ab1143c42-d2b0-4bac-9cc0-49a8411dbb5e","group":{"id":"advisory:b1143c42-d2b0-4bac-9cc0-49a8411dbb5e","revision":1,"primary_event_id":55862,"change":"published","superseded_by":[],"changed":{"id":55862,"cve_ids":["CVE-2026-114629"],"payload":{"kind":"advisory","title":"Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters","summary":"Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation. An attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.","evidence":"cve:CVE-2026-114629","products":[],"severity":"unknown","structured":{"id":"CVE-2026-114629","aliases":["CVE-2026-114629"],"metrics":[],"affected":[{"repo":"https://github.com/p5sagit/Web-Simple","modules":["Web::Simple"],"versions":[{"status":"affected","version":"0","lessThan":"0.035","versionType":"custom"}],"packageURL":"pkg:cpan/Web-Simple","packageName":"Web-Simple","programFiles":["lib/Web/Dispatch/ParamParser.pm"],"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","programRoutines":[{"name":"Web::Dispatch::ParamParser::get_unpacked_body_from"}]}],"modified":"2026-10-24T16:06:39.380Z","provider":"cve","references":["https://github.com/p5sagit/Web-Simple/commit/7e02c4f6204a2898938d357e6efe6dc2679af695.patch","https://metacpan.org/release/ETHER/Web-Simple-0.035/changes"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/24/4"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-24T16:06:39.380Z"}}],"cna":{"orgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","shortName":"CPANSec","dateUpdated":"2026-10-24T13:50:47.616Z"}}},"related_cves":[{"value":"CVE-2026-114629","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b1143c42-d2b0-4bac-9cc0-49a8411dbb5e","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114629","advisory_id":"b1143c42-d2b0-4bac-9cc0-49a8411dbb5e","event_types":["advisory"],"published_at":"2026-10-25T16:13:03.566801+00:00","technologies":["core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T13:50:47.616+00:00","detail_url":"/events/55862"},"members":[{"id":55862,"cve_ids":["CVE-2026-114629"],"payload":{"kind":"advisory","title":"Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters","summary":"Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation. An attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.","evidence":"cve:CVE-2026-114629","products":[],"severity":"unknown","structured":{"id":"CVE-2026-114629","aliases":["CVE-2026-114629"],"metrics":[],"affected":[{"repo":"https://github.com/p5sagit/Web-Simple","modules":["Web::Simple"],"versions":[{"status":"affected","version":"0","lessThan":"0.035","versionType":"custom"}],"packageURL":"pkg:cpan/Web-Simple","packageName":"Web-Simple","programFiles":["lib/Web/Dispatch/ParamParser.pm"],"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","programRoutines":[{"name":"Web::Dispatch::ParamParser::get_unpacked_body_from"}]}],"modified":"2026-10-24T16:06:39.380Z","provider":"cve","references":["https://github.com/p5sagit/Web-Simple/commit/7e02c4f6204a2898938d357e6efe6dc2679af695.patch","https://metacpan.org/release/ETHER/Web-Simple-0.035/changes"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/24/4"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-24T16:06:39.380Z"}}],"cna":{"orgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","shortName":"CPANSec","dateUpdated":"2026-10-24T13:50:47.616Z"}}},"related_cves":[{"value":"CVE-2026-114629","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b1143c42-d2b0-4bac-9cc0-49a8411dbb5e","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114629","advisory_id":"b1143c42-d2b0-4bac-9cc0-49a8411dbb5e","event_types":["advisory"],"published_at":"2026-10-25T16:13:03.566801+00:00","technologies":["core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T13:50:47.616+00:00","detail_url":"/events/55862"}]}}],"next_after":56339,"next_before":56339}