CVE-2026-114629: Web::Simple buffer allocation by Content-Length header

CVE-2026-114629 · Severity: info · Published 2026-10-24

Web::Simple is a Perl web application framework that handles incoming HTTP requests. A flaw in how it processes urlencoded form data allows an attacker to trigger excessive memory allocation by sending a request with a misleadingly large Content-Length header, potentially causing the application to consume large amounts of memory or crash.

Technologies: Perl Web::Simple. Vendors: Perl.

Quick answers

Is CVE-2026-114629 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-114629 being exploited in the wild.
How severe is CVE-2026-114629?
Informational severity, published 24 October 2026.
Which products and versions are affected?
Perl Web::Simple before 0.035.
Is there a fix for CVE-2026-114629?
Yes: fixed in Web::Simple 0.035. Until then: The fix changes the parser to read the body in 8 KiB chunks and enforces a configurable MAX_BODY_SIZE limit (defaulting to 8 MiB). If upgrading is not immediately possible, administrators can validate and reject requests with suspiciously large Content-Length headers before they reach the application. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114629 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-114629?
Check whether you run Perl Web::Simple at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Web::Simple 0.035

The fix changes the parser to read the body in 8 KiB chunks and enforces a configurable MAX_BODY_SIZE limit (defaulting to 8 MiB). If upgrading is not immediately possible, administrators can validate and reject requests with suspiciously large Content-Length headers before they reach the application.

Technical details

Web::Dispatch::ParamParser::get_unpacked_body_from allocates a buffer sized by the Content-Length header when reading application/x-www-form-urlencoded request bodies. Because Perl's read() method grows the buffer to the requested size before reading, an attacker can send a Content-Length value far larger than the actual body to trigger allocation of a correspondingly large buffer. The vulnerability requires only that the application route includes a body-parameter match (such as sub (POST + %name=)) and affects any application using affected Web::Simple versions.

Affected products

  • Perl Web::Simple before 0.035

Timeline

  • 2026-10-24: disclosed
  • 2026-10-23: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.