Hi,

The following vulnerability was published for libfurl-perl.

CVE-2026-65059[0]:
| Furl versions through 3.15 for Perl allow memory exhaustion via
| unbounded decompression of HTTP responses.  Furl inflates a response
| body sent with a gzip, x-gzip or deflate Content-Encoding and
| appends the output to the response string with no size limit. It
| does this whether or not the request asked for compression, and no
| option caps the decompressed size. Responses read with write_file or
| write_code are streamed rather than held in memory.  A malicious
| server, or an attacker on a plain HTTP connection, can send a small
| compressed response that expands to exhaust the client's memory and
| end the process.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-65059
https://www.cve.org/CVERecord?id=CVE-2026-65059
[1] https://github.com/tokuhirom/Furl/pull/139
[2] https://lists.security.metacpan.org/cve-announce/msg/44834406/
[3] https://github.com/tokuhirom/Furl/commit/aefd962428988265f687cea45511ad4942134cd9

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hello,

Bug #1153242 in libfurl-perl reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/perl-team/modules/packages/libfurl-perl/-/commit/9f08b1d89ab8c57a3cc28e63d1d574446901c235
------------------------------------------------------------------------
Add patches from upstream Git

to fix memory exhaustion via unbounded decompression of gzip/deflate
responses, a.k.a. "zip bomb" (CVE-2026-65059).

Closes: #1153242
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1153242

We believe that the bug you reported is fixed in the latest version of
libfurl-perl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1153242@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
gregor herrmann <gregoa@debian.org> (supplier of updated libfurl-perl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 06 Nov 2026 20:50:14 +0100
Source: libfurl-perl
Architecture: source
Version: 3.15-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed-By: gregor herrmann <gregoa@debian.org>
Closes: 1153242
Changes:
 libfurl-perl (3.15-2) unstable; urgency=medium
 .
   * Team upload.
   * Add patches from upstream Git to fix memory exhaustion via unbounded
     decompression of gzip/deflate responses, a.k.a. "zip bomb"
     (CVE-2026-65059). (Closes: #1153242)
   * Declare compliance with Debian Policy 4.7.4.
   * Convert debian/watch to version 5.
Checksums-Sha1:
 bb71be0649ce77240dc1ed99808174de86ba7e2f 2856 libfurl-perl_3.15-2.dsc
 f2461e6918f8442c01b2ab938f17ede0dd5c9f4e 12448 libfurl-perl_3.15-2.debian.tar.xz
 ef77702ece47c4a3426b9e59e0bf765575ebcc18 197376 libfurl-perl_3.15-2.git.tar.xz
 7f5863b595d813f2c4881451e7f2756c6d55329e 17753 libfurl-perl_3.15-2_source.buildinfo
Checksums-Sha256:
 a55d8d707637899362faf530438bf7ef5fde95aa1e800a18c855a884d7148ad4 2856 libfurl-perl_3.15-2.dsc
 68c92521007d799477bea421c390c768b0f86c941224f9b1a7e75250be8e8e2c 12448 libfurl-perl_3.15-2.debian.tar.xz
 74d49653fc46b6223261f2e1bc5451c668cd76abc772659f6543bc0e1a3c0660 197376 libfurl-perl_3.15-2.git.tar.xz
 504fe180c97cac75527f533b9df2272dff199b41a268f994eab00574a3e0fcbd 17753 libfurl-perl_3.15-2_source.buildinfo
Files:
 c98cbf684061534ba357216d41df0712 2856 perl optional libfurl-perl_3.15-2.dsc
 1df11366cd94b7d700dc49945837f732 12448 perl optional libfurl-perl_3.15-2.debian.tar.xz
 f648d0bcaad2a6adeb571191de720cd3 197376 perl None libfurl-perl_3.15-2.git.tar.xz
 b13dea5ad93e2668c57acfa1dfe1ea07 17753 perl optional libfurl-perl_3.15-2_source.buildinfo
Git-Tag-Info: tag=60702990f2a15ef8982f6f6f3c008a7dea3bf559 fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <gregoa@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmruMOkACgkQYG0ITkaD
wHnrfxAAh75TozO+d2IKDObt+0cEBUPY0CqoZZDPKUv6dS9Upxz85XyAuz+LW8bG
VX1pV2j4lba8o8FdDkDAN5NwdPQzB8toH462XqVShcb8PISAoA7+rQqxRdTP2Omb
jU2EXtbNxaWgjBsKX7+adu7ROio/L8raX2OpvZHhd/Ce/ipRJdidJ3mMw7MJlZnT
2EVIxvsfXGpuPuBORHoMsX1m9vB+bN6tZSXpkGxpbBVofLXJh1hFVc+ClClqFaD5
xZ6Mr+NmRSHClxBMdmPOVu2+m+dELdVyitpn/s1JZhyfpeVZ8M994CLLyJnsfnAk
GILsorxrcPRrOQbHk3Prqy6TeZQhW9e6Djt5oADX0yM9pdU1hosxsLbWTaNQ8HqU
7T6EIr5vDU1buulNx7yoq7euRSlx4SUvcILeeFG77F+rLWFDesCRlPxcjyYfe2NP
Kjz9pEqST1YkcGTyq84Cpy0Y3GuPy+vr2ray4QYE0nV2fO02crquG7sihMbkKgTJ
r9tvAGmP0pX7FjKQPQ04Eu5nPQuoy3wo+oZ1DuONjdvjqYQC3DLw9SzdgLCelDvD
BXbbr6PkGKzV3krbdKrrfyjAK1jT6G1zaHuaz1cI4auiR/nx/mUq9yfr7z6ShZFy
QGOhRk76qaf30dDA5dweIIC/CW71Z4AQezmQlOPK6vscMpZJE08=
=27pF
-----END PGP SIGNATURE-----