CVE-2026-114629: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-114629 is a Memory Allocation with Excessive Size Value (CWE-789) vulnerability in Web::Simple for Perl that enables unauthenticated denial-of-service attacks. All versions of Web::Simple before 0.035 are affected. The vulnerability was disclosed on October 24, 2026, by the CPAN Security Group (CPANSec), with a patch released the same day. No CVSS score has been formally assigned; Feedly estimates the severity as Medium, and the EPSS score is 0.0 (GitHub Advisory, oss-security).

The root cause is in Web::Dispatch::ParamParser::get_unpacked_body_from, which reads an application/x-www-form-urlencoded request body using a single Perl read() call sized directly by the Content-Length HTTP header, with no upper bound enforced and the return value ignored (CWE-789). Because Perl's read() pre-allocates a buffer of the declared size before reading, an attacker can force the server to allocate an arbitrarily large memory buffer simply by sending a crafted Content-Length header far exceeding the actual body size. The vulnerability is triggered on any route whose dispatch specification includes a % body-parameter match (e.g., sub (POST + %name=)), requiring no authentication. The fix in version 0.035 introduces chunked reading via a new _chunk_reader helper and enforces a configurable $MAX_BODY_SIZE limit (defaulting to 8 MiB) (GitHub Patch, oss-security).

Successful exploitation allows an unauthenticated remote attacker to cause the Perl application to allocate excessive memory, potentially exhausting system resources and crashing the service, resulting in a denial of service. The impact is limited to availability; there is no evidence of confidentiality or integrity compromise. Any application using Web::Simple with body-parameter route matching is at risk, and a single malicious request is sufficient to trigger the condition (GitHub Advisory, oss-security).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires no authentication and is trivially reproducible by sending a single HTTP POST request with an inflated Content-Length header to any affected route (GitHub Advisory, oss-security).

1. Reconnaissance: Identify web applications built with Web::Simple (Perl) that expose POST endpoints with body-parameter dispatch rules (e.g., sub (POST + %name=)). These may be discoverable via HTTP response headers, error messages, or CPAN-based application fingerprinting.
2. Craft malicious request: Construct an HTTP POST request targeting the vulnerable endpoint, setting the Content-Type header to application/x-www-form-urlencoded and the Content-Length header to an extremely large value (e.g., several gigabytes), while sending a minimal or empty body.
3. Send the request: Transmit the crafted request to the target server. Tools such as curl can be used: curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' -H 'Content-Length: 10737418240' --data '' http://target/endpoint
4. Trigger memory exhaustion: The vulnerable get_unpacked_body_from function calls Perl's read() with the attacker-controlled Content-Length value, causing the server process to attempt allocation of the declared buffer size, exhausting available memory and crashing or severely degrading the service (oss-security, GitHub Patch).

• Network: Inbound HTTP POST requests to application endpoints with Content-Type: application/x-www-form-urlencoded and anomalously large Content-Length values (e.g., exceeding 8 MiB or in the gigabyte range) but minimal or empty body content.
• Logs: Web server or application access logs showing POST requests with very large Content-Length values that do not correspond to actual body sizes; repeated such requests from the same source IP may indicate probing or attack.
• Process/System: Sudden spike in memory consumption by the Perl application process (perl, plackup, or similar); out-of-memory (OOM) killer events in system logs (/var/log/syslog, dmesg) referencing the Perl process; application crashes or restarts coinciding with unusual POST traffic.

Upgrade Web::Simple to version 0.035 or later, which introduces chunked body reading and enforces a default maximum body size of 8 MiB via $Web::Dispatch::ParamParser::MAX_BODY_SIZE. This limit is configurable in application code if larger bodies are required. As a workaround for deployments that cannot immediately upgrade, configure a reverse proxy (e.g., nginx, Apache) to reject requests with Content-Length values exceeding an acceptable threshold before they reach the application (oss-security, MetaCPAN Changelog).

The vulnerability was responsibly disclosed by Robert Rothenberg of the CPAN Security Group (CPANSec) via the oss-security mailing list on October 24, 2026, with a patch released simultaneously. A brief mention appeared on Bluesky via the infosec.skyfleet.blue account. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been observed (oss-security).