{"id":"CVE-2026-114629","revision":"d41ba000f6374488a8d085b9f59edbb7","records":[{"revision":"d41ba000f6374488a8d085b9f59edbb7","observedAt":"2026-10-24T18:17:04.385+00:00","statement":{"source":"cve-program","id":"CVE-2026-114629","aliases":[],"title":"Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters","description":"Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters.\n\nWeb::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation.\n\nAn attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.","state":0,"publishedAt":"2026-10-24T13:50:47.616+00:00","modifiedAt":"2026-10-24T16:06:39.38+00:00","affected":[{"ecosystem":"https://cpan.org/modules","name":"Web-Simple","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://cpan.org/modules\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"Web::Simple\"\n                    ],\n                    \"packageName\": \"Web-Simple\",\n                    \"packageURL\": \"pkg:cpan/Web-Simple\",\n                    \"programFiles\": [\n                        \"lib/Web/Dispatch/ParamParser.pm\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"Web::Dispatch::ParamParser::get_unpacked_body_from\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/p5sagit/Web-Simple\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"0.035\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://github.com/p5sagit/Web-Simple/commit/7e02c4f6204a2898938d357e6efe6dc2679af695.patch","https://metacpan.org/release/ETHER/Web-Simple-0.035/changes"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114629","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-114629","identifiers":["CVE-2026-114629"]},"retained":false,"historicalAffected":[]}],"coverage":[]}