CVE-2026-116135
HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form…
- Risk score
- 69/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them. The decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no entry and is replaced…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.23 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them. The decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no entry and is replaced with nothing, joining the bytes on either side. Hex digits in percent escapes are case-insensitive, and conforming decoders return the byte. A remote attacker can send a field name or value that a conforming decoder in front of the application reads differently, so that pass%aBword reaches the application as password.
Last activity 28 Oct 2026. Patch Forecast updates every hour.