# CVE-2026-116135: HTTP::Body percent-escape decoding bypass in urlencoded forms

Source: https://junglewise.ai/threats/cve-2026-116135-http-body-versions-before-1-23-01-for-perl-drop-mixed-case  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-116135 · Severity: info · Published 2026-10-28

HTTP::Body is a Perl library that parses HTTP request bodies, including form data. A flaw in how it decodes URL-encoded form field names and values causes mixed-case hex escapes (like %aB) to be silently dropped instead of decoded. An attacker can exploit this to bypass field name or value matching, potentially allowing authentication bypass or parameter injection if a conforming decoder in front of the application interprets the field differently.

Technologies: [Libwww-Perl HTTP::Body](https://junglewise.ai/threats/technologies/libwww-perl-http-body). Vendors: [Libwww-Perl](https://junglewise.ai/threats/vendors/libwww-perl).

## Quick answers

**Is CVE-2026-116135 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116135 being exploited in the wild.

**How severe is CVE-2026-116135?** Informational severity, published 28 October 2026.

**Which products and versions are affected?** Libwww-Perl HTTP::Body before 1.23_01.

**Is there a fix for CVE-2026-116135?** Yes: fixed in 1.23_01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116135 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116135?** Check whether you run Libwww-Perl HTTP::Body at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.23_01

## Technical details

HTTP::Body's URL decoder maintains separate decode tables for all-lowercase and all-uppercase hex pairs but matches escape sequences case-insensitively. Mixed-case escapes like %aB fail table lookup and are replaced with empty strings, joining adjacent bytes. An attacker can craft form data where the application and an upstream decoder interpret field names or values differently: for example, pass%aBword becomes password in the application but might decode differently in other systems.

## Affected products

- libwww-perl HTTP::Body before 1.23_01

## Timeline

- 2026-10-28: disclosed
- 2026-10-25: patched: patch committed

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/libwww-perl/HTTP-Body/commit/336f1a23b4115a5cbeb546f36df5af62c90bdc0d.patch](https://github.com/libwww-perl/HTTP-Body/commit/336f1a23b4115a5cbeb546f36df5af62c90bdc0d.patch)

## Related threats

- [HTTP::Body chunked request body parsing hang](https://junglewise.ai/threats/cve-2026-116531-http-body-versions-before-1-23-01-for-perl-lose-track-of-chunk)
- [HTTP::Body Perl multipart parser CPU exhaustion via quadratic rescanning](https://junglewise.ai/threats/cve-2026-116133-http-body-versions-before-1-23-01-for-perl-allow-cpu-exhaustion)
- [HTTP::Body temporary file disclosure in incomplete multipart uploads](https://junglewise.ai/threats/cve-2026-116132-http-body-versions-before-1-23-01-for-perl-leave-the-temporary)
- [HTTP::Body request body denial of service via field count exhaustion](https://junglewise.ai/threats/cve-2026-116131-http-body-versions-before-1-23-01-for-perl-allow-memory-and)