Vulnerability feed

Executive summary

Web::Simple versions before 0.035 for Perl have a flaw in how they handle urlencoded request bodies. The advisory states the flaw lets a request make the software allocate a buffer sized by the Content-Length header, and the advisory does not state a severity rating.

Technical summary

The weakness is an allocation based on an attacker-controlled Content-Length header for urlencoded request bodies, a resource exhaustion issue; the advisory does not name a specific CWE or CVSS score. The attack vector is a crafted HTTP POST, and the advisory does not state any further preconditions. The advisory says versions before 0.035 are affected; the fixed version is stated as 0.035 by the phrase 'versions before 0.035'. The patch reads urlencoded bodies in chunks, adds a configurable $Web::Dispatch::ParamParser::MAX_BODY_SIZE defaulting to 8 MiB, and croaks on oversized Content-Length values. The advisory does not state a workaround beyond the advice to validate Content-Length before dispatch, and it provides no detection guidance or information on exploitation in the wild.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/p5sagit/Web-Simple/commit/7e…fe6dc2679af695.patch

Score

No CVSS score published.

Affects

Web::SimpleWeb::Simple