{"id":"DEBIAN-CVE-2026-114629","details":"Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters.  Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation.  An attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.","modified":"2026-10-25T05:00:06.357758329Z","published":"2026-10-24T14:16:39.187Z","upstream":["CVE-2026-114629"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-114629"}],"affected":[{"package":{"name":"libweb-simple-perl","ecosystem":"Debian:12","purl":"pkg:deb/debian/libweb-simple-perl?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.033-2","0.035-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-114629.json"}},{"package":{"name":"libweb-simple-perl","ecosystem":"Debian:13","purl":"pkg:deb/debian/libweb-simple-perl?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.033-2","0.035-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-114629.json"}},{"package":{"name":"libweb-simple-perl","ecosystem":"Debian:14","purl":"pkg:deb/debian/libweb-simple-perl?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.033-2","0.035-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-114629.json"}}],"schema_version":"1.9.2"}