External risk intelligence

HTTP::Parser::XS PATH_INFO Truncation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-116130

HTTP::Parser::XS is a common library used to process incoming HTTP requests in Perl-based web applications and services. Because it is designed to parse web request paths at the application entry point, the vulnerable component is typically positioned as an internet-facing gateway or web service handler, making it a common target for external network traffic.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in a Perl parsing library that handles web request paths. The issue arises from how the library processes certain characters within a URL, potentially causing a discrepancy between how a proxy or filter interprets a request and how the application itself processes it. This could allow an attacker to manipulate requests in a way that bypasses security checks or leads to unexpected application behavior.

Library misinterprets web request paths.
Could allow bypassing security or causing issues.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted HTTP request containing an encoded NUL byte within the URL path. This crafted path would be partially processed by the vulnerable `HTTP::Parser::XS` component, while a downstream proxy or filter might examine a longer, unencoded version. This discrepancy could allow an attacker to bypass security checks or manipulate how the application interprets the request.

No authentication required.
Special characters in URL path.
Bypass security, manipulate requests.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, the HTTP::Parser::XS library's mishandling of encoded NUL bytes in request paths could allow an attacker to craft a URL that is interpreted differently by a proxy or filter compared to the application. This discrepancy could potentially affect how the application routes requests, impacting service behavior.

Request path data.
Proxy and application interpret paths differently.
May affect service behavior.

Operational Fix

Recommended remediation, mitigation, and detection steps

The real-world impact of this vulnerability likely falls to application owners and platform teams responsible for Perl-based web services. The first practical step is to identify all instances of the affected parser, determine their exposure and criticality, and then confirm ownership before planning remediation.

Application owners should verify usage.
Confirm network reachability and business impact.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is HTTP::Parser::XS?

HTTP::Parser::XS is a high-performance Perl module used to parse HTTP requests. Developers incorporate it into web applications and API services to efficiently handle incoming network traffic. It acts as an early-stage component that processes raw HTTP request data, including path information, before the application logic executes.

How does CVE-2026-116130 affect request parsing?

This vulnerability is classified as CWE-626. It occurs because the library uses a string length function that stops reading when it encounters an encoded NUL byte (%00). This causes the parser to truncate the URL path prematurely, meaning the application sees a different, shorter path than what was actually sent.

Do I need a special request to trigger this bug?

Yes, an attacker must send a specifically crafted HTTP request containing an encoded NUL byte within the path. Standard, well-formed traffic without these specific encoded characters does not trigger the truncation issue. The pure-Perl implementation of the parser is also safe from this specific behavior.

Is my application at risk if it uses this library?

If your service is internet-facing, Halo Surface Signal flags this as a likely concern because the library is typically used at the application entry point to handle incoming web traffic. This visibility creates a path for external attackers to exploit the discrepancy between what your security filters see and what your backend processes.

How should I begin responding to this CVE?

Start by identifying all Perl-based applications or services in your environment that rely on the HTTP::Parser::XS library. Once you have a comprehensive inventory, prioritize those that are network-accessible and verify if they are running a version earlier than 0.18. From there, coordinate with the responsible application teams to plan updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.