{"schema":"threatline.record/2","record":{"id":"CVE-2026-114629","aliases":[],"summary":"Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters","details":"Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters.\n\nWeb::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation.\n\nAn attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.","categories":["Unclassified"],"product":"","vendor":"","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114629","source_modified_at":"2026-10-24T16:06:39.380Z","fetched_at":"2026-10-24T18:03:20.872036Z","product":null,"vendor":null,"versions":[{"lessThan":"0.035","status":"affected","version":"0","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114629","source_modified_at":"2026-10-24T16:06:39.380Z","fetched_at":"2026-10-24T18:03:20.872036Z","package":{"name":null,"ecosystem":null},"version":"0.035","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-24T13:50:47.616Z","modified_at":"2026-10-24T16:06:39.380Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-114629","fetched_at":"2026-10-24T18:03:20.872036Z","source_modified_at":"2026-10-24T16:06:39.380Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/p5sagit/Web-Simple/commit/7e02c4f6204a2898938d357e6efe6dc2679af695.patch","tags":["patch"]},{"source":"CVE List","url":"https://metacpan.org/release/ETHER/Web-Simple-0.035/changes","tags":["release-notes"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-24T16:06:39.380Z","content_hash":"3ef3928a0709c3613f9b41a71b3310167f8fce0537a6f16702361676441aec16"}}