Hi,

The following vulnerability was published for libhttp-parser-xs-perl.

CVE-2026-116130[0]:
| HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at
| an encoded NUL byte in parse_http_request.  The XS parser URL-
| decodes the request path and measures the result with strlen(), so
| PATH_INFO ends at the first byte decoded from %00. The pure-Perl
| backend is not affected.  A remote attacker can send a path that a
| proxy or filter checks in full while the application routes on a
| shorter one.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-116130
https://www.cve.org/CVERecord?id=CVE-2026-116130
[1] https://lists.security.metacpan.org/cve-announce/msg/44760361/
[2]  https://github.com/kazuho/p5-http-parser-xs/commit/f388b9d7994722b01edd03d57de7d2fb819e1aae

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
libhttp-parser-xs-perl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1152633@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
gregor herrmann <gregoa@debian.org> (supplier of updated libhttp-parser-xs-perl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 30 Oct 2026 23:06:48 +0100
Source: libhttp-parser-xs-perl
Architecture: source
Version: 0.18-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed-By: gregor herrmann <gregoa@debian.org>
Closes: 1152633
Changes:
 libhttp-parser-xs-perl (0.18-1) unstable; urgency=medium
 .
   [ Debian Janitor ]
   * Update standards version to 4.6.1, no changes needed.
 .
   [ gregor herrmann ]
   * Import upstream version 0.18.
     - preserve the full URL-decoded PATH_INFO when it contains NUL bytes
     A.k.a. CVE-2026-116130 (closes: #1152633)
   * Update years of packaging copyright.
   * Declare compliance with Debian Policy 4.7.4.
   * Remove «Rules-Requires-Root: no», which is the current default.
   * Remove «Priority: optional», which is the current default.
   * Convert debian/watch to version 5.
Checksums-Sha1:
 87b728b99f38f23c4b2a0b75c0d055a09d85ac58 2522 libhttp-parser-xs-perl_0.18-1.dsc
 cba31bfc98418ffe0482af60dff694fbcbe15854 80192 libhttp-parser-xs-perl_0.18.orig.tar.gz
 2f0c5ead78ddc136dedc3f939517dc182584b9d8 3596 libhttp-parser-xs-perl_0.18-1.debian.tar.xz
 9122db2e34af3827db3f86230e22229a27e07743 166204 libhttp-parser-xs-perl_0.18-1.git.tar.xz
 aa57413a9868755007e3278e5c65a049f36ab1f6 17793 libhttp-parser-xs-perl_0.18-1_source.buildinfo
Checksums-Sha256:
 fd3365e404df616250ef18a6df6bd93ff80630b761fe0b230d0953beed642a31 2522 libhttp-parser-xs-perl_0.18-1.dsc
 4a3c409b40ec56b18e23c302339bff2411a66e1ed6a822412f268eb698600afd 80192 libhttp-parser-xs-perl_0.18.orig.tar.gz
 eb23d04a09817dd9c9a40197bc3ce5220b0c7d07b9f9b014bbf872782dceb6b8 3596 libhttp-parser-xs-perl_0.18-1.debian.tar.xz
 3103b2a0b0b81269b37cb56600d10f434198bfb22b5e7fdb215800645e47642b 166204 libhttp-parser-xs-perl_0.18-1.git.tar.xz
 cb4029b398874083ad3f5130b091907b61bf0c2675e1f9177868e4965349c422 17793 libhttp-parser-xs-perl_0.18-1_source.buildinfo
Files:
 66fc203882545db9757d25eac5d2af79 2522 perl optional libhttp-parser-xs-perl_0.18-1.dsc
 2ed0b171dfafdfaea247c588a26611e2 80192 perl optional libhttp-parser-xs-perl_0.18.orig.tar.gz
 78ee1faad09937c8da0d4bc1af201d65 3596 perl optional libhttp-parser-xs-perl_0.18-1.debian.tar.xz
 e5148616882f3b90ed7f8badeef99f23 166204 perl None libhttp-parser-xs-perl_0.18-1.git.tar.xz
 c46e8186bcf6cb282c2aebbb03db8874 17793 perl optional libhttp-parser-xs-perl_0.18-1_source.buildinfo
Git-Tag-Info: tag=5a0e00870f00ad955ff5abadc49f87f5ea978a14 fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <gregoa@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIyBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrlFbYACgkQYG0ITkaD
wHkhMA/4xN5vXjWe+vu3gpmp04RgtZ38zRyLAi8CWMgeU9fRjj27yHjM8DE4+j9S
yJ1VYF2boyNtbDruvU8V7yJApI7uoIe0yr5ym56NgPH1RcSXSbKMDfxP26U8wTSM
mO2OGbgtCtrKoBiVQlFbUBn1hV6zprGtihhSRhgyEFKaOlpOf0OEVeomq1nsCz4s
TfGiU7TLBWydzOyhcxVtGYPfbw7DKY+um3ZEts2LOMIjhSTzWndFLoE4LrrStoF9
lxKVxsF0GXSWfgcz4+9O66s6MjgaYaJ+iEMMGnuHrNDZ7m2Did/WMn6ZrA3HllOm
IK+p/GwlVU3GHqFL5Lon42V+Ymq3mS5970WErcKmP/gvWJDW5B2mv8h6OvNOlaah
6821NR2dbBOwLv2ypu9loBUGE7zBj9Ct/MI7j1VEEOUSm8Brj27wrLBzLLNybanb
PBeFd+6uKedLx8qayCkYpp1uHwDxb9LbHu2QqfPyOfveEn0znMJKd/YyReZ8ZovD
EpCxD1ReAxhBHCet7bVY9mpLiWGVSFsD26kDIACKcl/jN5Vd37wvDVgJ94WaZxJd
hAsKMHICx3GtwP1LfleqhFi36ci6tXIuHbKVurqHsxcwH4Z7riI4t1Xo07evbmvA
k90XmdIRIB/z4amB/CY/IXj/jnrlaNnbX+VezMjthFj+VQCNiw==
=Iehr
-----END PGP SIGNATURE-----