Is CVE-2026-116135 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116135 being exploited in the wild.

How severe is CVE-2026-116135?

Informational severity, published 28 October 2026.

Which products and versions are affected?

Libwww-Perl HTTP::Body before 1.23_01.

Is there a fix for CVE-2026-116135?

Yes: fixed in 1.23_01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116135 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116135?

Check whether you run Libwww-Perl HTTP::Body at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116135: HTTP::Body percent-escape decoding bypass in urlencoded forms

CVE-2026-116135 · Severity: info · Published 2026-10-28

HTTP::Body is a Perl library that parses HTTP request bodies, including form data. A flaw in how it decodes URL-encoded form field names and values causes mixed-case hex escapes (like %aB) to be silently dropped instead of decoded. An attacker can exploit this to bypass field name or value matching, potentially allowing authentication bypass or parameter injection if a conforming decoder in front of the application interprets the field differently.

Technologies: Libwww-Perl HTTP::Body. Vendors: Libwww-Perl.

Quick answers

Is CVE-2026-116135 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116135 being exploited in the wild.
How severe is CVE-2026-116135?: Informational severity, published 28 October 2026.
Which products and versions are affected?: Libwww-Perl HTTP::Body before 1.23_01.
Is there a fix for CVE-2026-116135?: Yes: fixed in 1.23_01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116135 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116135?: Check whether you run Libwww-Perl HTTP::Body at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.23_01

Technical details

HTTP::Body's URL decoder maintains separate decode tables for all-lowercase and all-uppercase hex pairs but matches escape sequences case-insensitively. Mixed-case escapes like %aB fail table lookup and are replaced with empty strings, joining adjacent bytes. An attacker can craft form data where the application and an upstream decoder interpret field names or values differently: for example, pass%aBword becomes password in the application but might decode differently in other systems.

Affected products

libwww-perl HTTP::Body before 1.23_01

Timeline

2026-10-28: disclosed
2026-10-25: patched: patch committed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.