UnratedVulnerabilityCVE-2026-116130updated 30 Oct 2026, 13:20 UTC

HTTP::Parser::XS for Perl truncates PATH_INFO at encoded NUL byte (CVE-2026-116130)

Official, 2 sources

Severity	UnratedVulnerability
Being exploited?	UnclearNo reports either way yet
Fix available?	UnclearNo fixed version published in the sources yet
How sure is this?	Official, 2 sourcesBacked by an official source

Timeline

30 Oct 2026, 12:54 UTC
Publicly disclosed
30 Oct 2026, 12:54 UTC
Reported by oss-security · oss-security
30 Oct 2026, 13:00 UTC
Picked up by Zero Radar
30 Oct 2026, 13:20 UTC
NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

CVE-2026-116130NVD · 30 Oct 2026, 13:18 UTC

Security researchers research teams and mailing lists

CVE-2026-116130: HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_requestoss-security · 30 Oct 2026, 12:54 UTC

Technical details

ID: CVE-2026-116130
Disclosed: 30 Oct 2026, 12:54 UTC
On Zero Radar: 30 Oct 2026, 13:00 UTC (6 min after disclosure)
Last change: 30 Oct 2026, 13:20 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

HTTP::Parser::XS for Perl truncates PATH_INFO at encoded NUL byte (CVE-2026-116130) · Zero Radar