# CVE-2026-114629: Web::Simple buffer allocation by Content-Length header

Source: https://junglewise.ai/threats/cve-2026-114629-web-simple-versions-before-0-035-for-perl-allocate-a-buffer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-24. Updated: 2026-10-24  
License: CC BY 4.0 with a link back

CVE-2026-114629 · Severity: info · Published 2026-10-24

Web::Simple is a Perl web application framework that handles incoming HTTP requests. A flaw in how it processes urlencoded form data allows an attacker to trigger excessive memory allocation by sending a request with a misleadingly large Content-Length header, potentially causing the application to consume large amounts of memory or crash.

Technologies: [Perl Web::Simple](https://junglewise.ai/threats/technologies/web-simple). Vendors: [Perl](https://junglewise.ai/threats/vendors/perl).

## Quick answers

**Is CVE-2026-114629 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114629 being exploited in the wild.

**How severe is CVE-2026-114629?** Informational severity, published 24 October 2026.

**Which products and versions are affected?** Perl Web::Simple before 0.035.

**Is there a fix for CVE-2026-114629?** Yes: fixed in Web::Simple 0.035. Until then: The fix changes the parser to read the body in 8 KiB chunks and enforces a configurable MAX_BODY_SIZE limit (defaulting to 8 MiB). If upgrading is not immediately possible, administrators can validate and reject requests with suspiciously large Content-Length headers before they reach the application. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114629 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114629?** Check whether you run Perl Web::Simple at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Web::Simple 0.035

The fix changes the parser to read the body in 8 KiB chunks and enforces a configurable MAX_BODY_SIZE limit (defaulting to 8 MiB). If upgrading is not immediately possible, administrators can validate and reject requests with suspiciously large Content-Length headers before they reach the application.

## Technical details

Web::Dispatch::ParamParser::get_unpacked_body_from allocates a buffer sized by the Content-Length header when reading application/x-www-form-urlencoded request bodies. Because Perl's read() method grows the buffer to the requested size before reading, an attacker can send a Content-Length value far larger than the actual body to trigger allocation of a correspondingly large buffer. The vulnerability requires only that the application route includes a body-parameter match (such as sub (POST + %name=)) and affects any application using affected Web::Simple versions.

## Affected products

- Perl Web::Simple before 0.035

## Timeline

- 2026-10-24: disclosed
- 2026-10-23: patched

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/p5sagit/Web-Simple/commit/7e02c4f6204a2898938d357e6efe6dc2679af695.patch](https://github.com/p5sagit/Web-Simple/commit/7e02c4f6204a2898938d357e6efe6dc2679af695.patch)

## Related threats

- [Web::Simple HTML::Tags single-quoted attribute XSS](https://junglewise.ai/threats/cve-2026-120212-web-simple-versions-before-0-037-for-perl-do-not-escape-single)