CVE-2026-65059: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-65059 is a denial-of-service vulnerability in Furl, a Perl HTTP client library, caused by unbounded decompression of HTTP responses (a "zip bomb" attack). All versions through 3.15 are affected. The vulnerability was disclosed on November 2, 2026, and is classified under CWE-409 (Improper Handling of Highly Compressed Data). The CVSS score has not been formally assigned at this time (ENISA lists a base score of 0.0 pending review), and the CVE status is currently "Deferred" (GitHub Advisory, Feedly).

The root cause lies in Furl::ZlibStream (see lib/Furl/ZlibStream.pm), which inflates HTTP response bodies sent with gzip, x-gzip, or deflate Content-Encoding and appends the decompressed output to the response string with no size limit (CWE-409). Critically, this decompression occurs regardless of whether the original request included an Accept-Encoding header requesting compression, and no configuration option exists to cap the decompressed size. The exception is responses consumed via write_file or write_code callbacks, which are streamed rather than buffered in memory. A fix was proposed in GitHub pull request #139 by researcher robrwo (GitHub PR #139, GitHub Advisory).

A malicious HTTP server, or a network-positioned attacker intercepting a plain HTTP connection, can send a small compressed payload that decompresses to an arbitrarily large size, exhausting the client process's available memory and causing it to crash. This results in a denial-of-service condition affecting the availability of any Perl application using Furl for HTTP communication. There is no direct confidentiality or integrity impact, but crashing client processes could disrupt dependent services or workflows (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires either control of an HTTP server that the victim Furl client connects to, or a man-in-the-middle position on a plain HTTP connection — no authentication is required on the attacker's part (GitHub Advisory, Feedly).

1. Identify a target: Locate a Perl application using Furl ≤ 3.15 that makes HTTP requests to an attacker-controlled or interceptable endpoint.
2. Prepare a zip bomb payload: Craft a highly compressed HTTP response body (e.g., using gzip) that expands to a very large size upon decompression — a classic zip bomb (e.g., a file that compresses to kilobytes but expands to gigabytes).
3. Serve or inject the malicious response: Either operate a malicious HTTP server that the target client connects to, or perform a man-in-the-middle attack on a plain HTTP connection to inject the crafted response with a Content-Encoding: gzip (or deflate) header.
4. Trigger decompression: When the Furl client receives the response, Furl::ZlibStream automatically decompresses it without any size limit, appending the output to the response string in memory.
5. Exhaust memory: The decompressed data fills available memory, causing the Perl process to crash or be killed by the OS OOM killer, achieving denial of service (GitHub PR #139, GitHub Advisory).

• Process: Perl processes consuming abnormally high or rapidly growing memory, potentially terminated by the OS out-of-memory (OOM) killer.
• Logs: System logs (e.g., /var/log/syslog or dmesg) showing OOM killer events targeting Perl processes; application crash logs or unhandled exceptions from Furl-based applications.
• Network: HTTP responses from unexpected servers or unusual endpoints containing Content-Encoding: gzip, x-gzip, or deflate headers with disproportionately small response body sizes relative to the declared or implied content.

Update Furl to a version greater than 3.15 once a patched release is published; the fix is currently proposed in GitHub PR #139 but has not yet been merged into a stable release. As an interim workaround, restrict Furl-based applications to connect only to trusted HTTPS servers (to prevent MITM injection) and avoid connections to untrusted or user-controlled HTTP endpoints. Additionally, consider implementing OS-level memory limits (e.g., ulimit) on Perl processes to reduce the blast radius of a successful attack (GitHub Advisory, Feedly).

The vulnerability was noted on Bluesky by the infosec community shortly after disclosure. The fix was developed with assistance from Claude Opus 5.5 (an AI coding assistant), as noted in the pull request description by researcher robrwo. No major vendor statements or significant media coverage have been identified beyond the initial advisory and OSS-Sec mailing list post (GitHub PR #139, OSS-Sec).