Hi,

The following vulnerability was published for libweb-simple-perl.

CVE-2026-114629[0]:
| Web::Simple versions before 0.035 for Perl allocate a buffer sized
| by the Content-Length header for urlencoded body parameters.
| Web::Dispatch::ParamParser::get_unpacked_body_from reads an
| application/x-www-form-urlencoded body using a single read call,
| with no cap and the return value ignored. Perl's read grows the
| buffer to the requested length before reading, so the declared
| Content-Length determines the allocation.  An attacker can trigger
| this through any route whose dispatch specification has a % body-
| parameter match, such as sub (POST + %name=), sending a Content-
| Length far larger than the body actually sent. No authentication is
| involved.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-114629
https://www.cve.org/CVERecord?id=CVE-2026-114629
[1] https://lists.security.metacpan.org/cve-announce/msg/44599125/

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
libweb-simple-perl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1151935@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
gregor herrmann <gregoa@debian.org> (supplier of updated libweb-simple-perl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 25 Oct 2026 01:11:56 +0200
Source: libweb-simple-perl
Architecture: source
Version: 0.035-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed-By: gregor herrmann <gregoa@debian.org>
Closes: 1151935
Changes:
 libweb-simple-perl (0.035-1) unstable; urgency=medium
 .
   * Import upstream version 0.035.
     - A urlencoded body is read in chunks (CVE-2026-114629)
     Closes: #1151935
   * Update debian/upstream/metadata.
   * Update years of upstream and packaging copyright.
   * Update dependencies.
   * Declare compliance with Debian Policy 4.7.4.
   * Remove «Priority: optional», which is the current default.
   * Annotate test-only build dependencies with <!nocheck>.
   * Convert debian/watch to version 5.
Checksums-Sha1:
 c8629e18e6a2565565c55e3eb45d0c101ad585e2 2786 libweb-simple-perl_0.035-1.dsc
 862b377a23049ea2db26cc97b42734fea2fd59a5 61286 libweb-simple-perl_0.035.orig.tar.gz
 a904b9bb0470cedf38ece15ed36f3498ac9f300f 4056 libweb-simple-perl_0.035-1.debian.tar.xz
 8a98a181907099fadabeb6efde039960139c7106 129992 libweb-simple-perl_0.035-1.git.tar.xz
 c336de68303e6e58a4f5834e23697d8f4e06dd7f 17776 libweb-simple-perl_0.035-1_source.buildinfo
Checksums-Sha256:
 dd41df5f28adaa88d254ec56d671634a45827124144b00bbe8390157cfd26571 2786 libweb-simple-perl_0.035-1.dsc
 9b7cea77a2cb09e88a78f450a4f21458a62e71e4696e7bdf2a1181694fbea21c 61286 libweb-simple-perl_0.035.orig.tar.gz
 29316eb28c05dd000ba06854e8f048dd756af9c6e7970417c7b6588927a45a92 4056 libweb-simple-perl_0.035-1.debian.tar.xz
 5e39a891290a3f15265d5fdfe005a355f35ac38021347fc3c166d640bc7ee342 129992 libweb-simple-perl_0.035-1.git.tar.xz
 1335299bb9f88cb356f73d1ca6bcb2fe3ba6833fd5fe8884896a4017d1e833c2 17776 libweb-simple-perl_0.035-1_source.buildinfo
Files:
 d2fa30267bda933d1d2ea66f9181eb13 2786 perl optional libweb-simple-perl_0.035-1.dsc
 9716ee8792ee2cbc48be653df2ae7784 61286 perl optional libweb-simple-perl_0.035.orig.tar.gz
 80dbb5680933c4a597a8f1e6f3a4bf60 4056 perl optional libweb-simple-perl_0.035-1.debian.tar.xz
 43634cca7dc814af2abcbc1ff3fca897 129992 perl None libweb-simple-perl_0.035-1.git.tar.xz
 98c6e8af3d811e1d21becb1bddf59abd 17776 perl optional libweb-simple-perl_0.035-1_source.buildinfo
Git-Tag-Info: tag=99e74bb21143f671e18e0062176c23b55353246f fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <gregoa@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrdPD4ACgkQYG0ITkaD
wHnOfw/+Ij2q7QJx0uE+r6JBoKDcLNnj+DLk6Giv7libAxzBS551fxOvPVO80eTp
Hlm+MqJlFxeoti0OImnmY/o9u/yksLQQhEER6Qc3zJ2rtEYPMix7Kc29FUpzqWm2
EIPF2kaGbG3a3yyDBfbBuEUZUBPQQ83UBjYd6kV9DGFg3mHsxJOvQI4bhqn13IBK
cXe9g8xCXQjLGrQjMt0pScf6Y/TihbaIKV7xysBkE5KgGunVmSyvROpFPiN0Nof7
JC9dz+qEQtYc/pg9HsN5Sbce8LkvnASYrPYUXNkeGlirM4Z5aJ+Y25ijYOa3TwOx
04koiUittqM606QEPDVBMI2LEg/pTST5NSA9N301Z6WOeKBDMdu+bd7JGs8bkm3c
vStJs21mvnfYtWohEGWZ39dYDNQ0+6w7LCiiB5vDYzplmJzub/o3ktWyzhwJT7Vx
XmSrXi/XiChIz2UBlHbOLFwN2mHa42RVXiMC031Qv0mIKrUx044UuQnvl+kuuI76
GGLtQBMpVTDu1hb7W14KvVlkCEX4a4Y+9jbXo+6TmVAQl935QBTEWU6DgQGhhl0j
RqA9WjZIx/kBOexOY7Td9kQWFaLnd6JMxJXkOK46nsABsapUnkPSYJ5jYo4+ITOZ
mU+3DL9GSI/aZ7C71DZSgCXDa+BjG7L2jM2hgZRXfhpH9R46Tgg=
=inUz
-----END PGP SIGNATURE-----