CVE-2026-116135

The record

HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them. The decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no entry and is replaced with nothing, joining the bytes on either side. Hex digits in percent escapes are case-insensitive, and conforming decoders return the byte. A remote attacker can send a field name or value that a conforming decoder in front of the application reads differently, so that pass%aBword reaches the application as password.

Affected packages

Related vulnerabilities

• CVE-2026-63121 Kubewarden policies is a collection of WebAssembly policies for securing and governing… CWE-178
• CVE-2026-109411 An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's… CWE-178
• CVE-2026-108313 Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server. CWE-178
• CVE-2026-116469 MISP Guard, a proxy-based security filter for MISP feed distribution, contains a… CWE-178
• CVE-2026-114132 Nuxt is an open-source web development framework for Vue.js. CWE-178
• CVE-2026-109841 undici is an HTTP client library for Node.js. CWE-178
• CVE-2026-86472 fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. CWE-178
• CVE-2026-87876 Two case-insensitive comparisons on request-derived usernames outside the main… CWE-178